World university web census · gap lists · census 2026-09-30 · JSON (top 50) · feed
Universities with an expired security.txt
61 of the 10,265 universities in the census list (0.6%; 0.9% of the 6,811 reachable over HTTPS), as fetched on 2026-09-30.
On this list
61
of 10,265 universities
Share of the list
0.6%
0.9% of reachable sites
Countries
23
largest: the United States (10)
Full list
1.00 USDC
x402, per file; first 50 rows free
What this gap means
A security.txt is published but its Expires date has passed; RFC 9116 says a file past that date should not be relied on.
Control: security.txt Expires line (RFC 9116). Rule: expired_security_txt over the census record (reachable sites only). Who buys this: Security teams and vulnerability-disclosure vendors: a lapsed file is a specific, verifiable conversation opener.
The obligation it maps to
Vulnerability disclosure: security.txt (RFC 9116): RFC 9116 defines /.well-known/security.txt so researchers can find a contact and a policy; many national cyber agencies and the higher-education ISACs recommend it. Source
By country
23 countries with at least one university on this list; "of the country" is the share of its universities in the census list. One country as CSV: 0.25 USDC (x402).
| Country | On this list | Of the country | CSV (x402) |
|---|---|---|---|
| the United States | 10 | 0.4% | https://universities.agentexchange.work/leads/expired-security-txt/state/US.csv |
| Switzerland | 7 | 9.2% | https://universities.agentexchange.work/leads/expired-security-txt/state/CH.csv |
| the United Kingdom | 5 | 2.6% | https://universities.agentexchange.work/leads/expired-security-txt/state/GB.csv |
| Sweden | 5 | 13.5% | https://universities.agentexchange.work/leads/expired-security-txt/state/SE.csv |
| Germany | 4 | 1.2% | https://universities.agentexchange.work/leads/expired-security-txt/state/DE.csv |
| Portugal | 4 | 6.2% | https://universities.agentexchange.work/leads/expired-security-txt/state/PT.csv |
| Canada | 3 | 1.9% | https://universities.agentexchange.work/leads/expired-security-txt/state/CA.csv |
| Indonesia | 3 | 1.5% | https://universities.agentexchange.work/leads/expired-security-txt/state/ID.csv |
| the Netherlands | 3 | 6.3% | https://universities.agentexchange.work/leads/expired-security-txt/state/NL.csv |
| Australia | 2 | 3.4% | https://universities.agentexchange.work/leads/expired-security-txt/state/AU.csv |
| Finland | 2 | 5.7% | https://universities.agentexchange.work/leads/expired-security-txt/state/FI.csv |
| France | 2 | 0.7% | https://universities.agentexchange.work/leads/expired-security-txt/state/FR.csv |
| BA | 1 | — | https://universities.agentexchange.work/leads/expired-security-txt/state/BA.csv |
| Brazil | 1 | 0.5% | https://universities.agentexchange.work/leads/expired-security-txt/state/BR.csv |
| Spain | 1 | 1.0% | https://universities.agentexchange.work/leads/expired-security-txt/state/ES.csv |
| GU | 1 | — | https://universities.agentexchange.work/leads/expired-security-txt/state/GU.csv |
| Ireland | 1 | 3.7% | https://universities.agentexchange.work/leads/expired-security-txt/state/IE.csv |
| IR | 1 | 0.5% | https://universities.agentexchange.work/leads/expired-security-txt/state/IR.csv |
| Italy | 1 | 1.1% | https://universities.agentexchange.work/leads/expired-security-txt/state/IT.csv |
| Norway | 1 | 4.2% | https://universities.agentexchange.work/leads/expired-security-txt/state/NO.csv |
| PK | 1 | 0.7% | https://universities.agentexchange.work/leads/expired-security-txt/state/PK.csv |
| PS | 1 | — | https://universities.agentexchange.work/leads/expired-security-txt/state/PS.csv |
| TR | 1 | 0.5% | https://universities.agentexchange.work/leads/expired-security-txt/state/TR.csv |
Free: the first 50 of 61 (alphabetical)
| Domain | Country | Country | Domains known for the institution | Census record |
|---|---|---|---|---|
| aston.ac.uk Aston University | United Kingdom | GB | HTTP 200 · HSTS yes · security.txt expired · privacy yes · accessibility yes · GPTBot partly blocked | |
| bfh.ch BFH - Bern University of Applied Sciences | Switzerland | CH | HTTP 200 · HSTS yes · security.txt expired · privacy no · accessibility no · GPTBot allowed | |
| chester.ac.uk University of Chester | United Kingdom | GB | HTTP 200 · HSTS yes · security.txt expired · privacy yes · accessibility yes · GPTBot partly blocked | |
| dct.ch DCT International Hotel & Business Management School | Switzerland | CH | HTTP 200 · HSTS yes · security.txt expired · privacy no · accessibility no | |
| ddu.nl Dutch Delta University | Netherlands | NL | HTTP 200 · HSTS yes · security.txt expired · privacy no · accessibility no | |
| devinci.fr Ecole Superieur d'Ingenieurs Leonard de Vinci | France | FR | HTTP 200 · HSTS yes · security.txt expired · privacy no · accessibility no · GPTBot partly blocked | |
| efh-bochum.de Evangelische Fachhochschule Rheinland-Westfalen-Lippe | Germany | DE | HTTP 404 · HSTS no · security.txt expired · privacy no · accessibility no | |
| epfl.ch EPFL - EPF Lausanne | Switzerland | CH | 2 domains | HTTP 200 · HSTS yes · security.txt expired · privacy no · accessibility no |
| federation.edu.au Federation University Australia | Australia | AU | HTTP 200 · HSTS yes · security.txt expired · privacy yes · accessibility yes · GPTBot allowed | |
| fh-brandenburg.de Fachhochschule Brandenburg | Germany | DE | HTTP 200 via www.th-brandenburg.de · HSTS yes · security.txt expired · privacy no · accessibility no · GPTBot partly blocked | |
| fh-potsdam.de Fachhochschule Potsdam | Germany | DE | HTTP 200 · HSTS yes · security.txt expired · privacy no · accessibility no · GPTBot partly blocked | |
| fhsg.ch FHS St.Gallen | Switzerland | CH | HTTP 200 via www.ost.ch · HSTS no · security.txt expired · privacy no · accessibility no · GPTBot partly blocked | |
| gmit.ie Galway Mayo Institute of Technology | Ireland | IE | HTTP 200 via www.atu.ie · HSTS yes · security.txt expired · privacy yes · accessibility yes · GPTBot partly blocked | |
| gre.ac.uk University of Greenwich | United Kingdom | GB | HTTP 200 · HSTS yes · security.txt expired · privacy yes · accessibility yes · GPTBot partly blocked | |
| hanze.nl Hanze University Groningen | Netherlands | NL | HTTP 200 · HSTS yes · security.txt expired · privacy no · accessibility no · GPTBot partly blocked | |
| hebron.edu Hebron University | Palestine, State of | PS | HTTP 200 · HSTS yes · security.txt expired · privacy no · accessibility no · GPTBot partly blocked | |
| hilo.hawaii.edu University of Hawaii at Hilo | United States | US | HTTP 200 · HSTS yes · security.txt expired · privacy no · accessibility no · GPTBot partly blocked | |
| hkr.se University College of Kristianstad | Sweden | SE | HTTP 200 · HSTS yes · security.txt expired · privacy no · accessibility no · GPTBot partly blocked | |
| hsr.ch HSR - Hochschule für Technik Rapperswil | Switzerland | CH | HTTP 200 via www.ost.ch · HSTS no · security.txt expired · privacy no · accessibility no · GPTBot partly blocked | |
| ipb.pt Instituto Politécnico de Bragança | Portugal | PT | HTTP 200 via unipb.pt · HSTS no · security.txt expired · privacy no · accessibility no | |
| ius.edu.ba International University of Sarajevo | Bosnia and Herzegovina | BA | HTTP 200 · HSTS yes · security.txt expired · privacy yes · accessibility no · GPTBot partly blocked | |
| kau.se Karlstad University | Sweden | SE | HTTP 200 · HSTS yes · security.txt expired · privacy no · accessibility no · GPTBot partly blocked | |
| konstfack.se University College of Arts, Crafts and Design | Sweden | SE | HTTP 200 · HSTS yes · security.txt expired · privacy no · accessibility no · GPTBot partly blocked | |
| kristiania.no Kristiania University College | Norway | NO | HTTP 200 · HSTS yes · security.txt expired · privacy no · accessibility no · GPTBot partly blocked | |
| lccc.wy.edu Laramie County Community College | United States | US | HTTP 200 · HSTS no · security.txt expired · privacy yes · accessibility yes · GPTBot partly blocked | |
| lu.se Lund University | Sweden | SE | HTTP 200 · HSTS no · security.txt expired · privacy no · accessibility no · GPTBot partly blocked | |
| mdh.se Mälardalen University | Sweden | SE | HTTP 200 via www.mdu.se · HSTS no · security.txt expired · privacy no · accessibility no · GPTBot partly blocked | |
| mmu.ac.uk The Manchester Metropolitan University | United Kingdom | GB | HTTP 200 · HSTS yes · security.txt expired · privacy no · accessibility yes · GPTBot partly blocked | |
| ntb.ch NTB - Hochschule für Technik Buchs | Switzerland | CH | HTTP 200 via www.ost.ch · HSTS no · security.txt expired · privacy no · accessibility no · GPTBot partly blocked | |
| princeton.edu Princeton University | United States | US | HTTP 403 · HSTS no · security.txt expired · privacy no · accessibility no · GPTBot partly blocked | |
| pvamu.edu Prairie View A&M University | United States | US | HTTP 200 · HSTS no · security.txt expired · privacy no · accessibility no · GPTBot allowed | |
| rmit.edu.au Royal Melbourne Institute of Technology | Australia | AU | HTTP 200 · HSTS yes · security.txt expired · privacy no · accessibility no · GPTBot partly blocked | |
| rumeli.edu.tr Istanbul Rumeli University | Turkiye | TR | HTTP 403 · HSTS yes · security.txt expired · privacy no · accessibility no · GPTBot allowed | |
| shahroodut.ac.ir Shahrood University of Technology | Iran | IR | HTTP 200 · HSTS no · security.txt expired · privacy no · accessibility no · GPTBot allowed | |
| soas.ac.uk School of Oriental and African Studies, University of London | United Kingdom | GB | HTTP 200 · HSTS yes · security.txt expired · privacy yes · accessibility yes · GPTBot partly blocked | |
| tamu.edu Texas A&M University - College Station | United States | US | HTTP 200 · HSTS yes · security.txt expired · privacy yes · accessibility yes · GPTBot allowed | |
| tcc.fl.edu Tallahassee Community College | United States | US | HTTP 200 via www.tsc.fl.edu · HSTS yes · security.txt expired · privacy yes · accessibility yes | |
| th-brandenburg.de Technische Hochschule Brandenburg | Germany | DE | HTTP 200 · HSTS yes · security.txt expired · privacy no · accessibility no · GPTBot partly blocked | |
| tut.fi Tampere University of Technology | Finland | FI | HTTP 200 via www.tuni.fi · HSTS yes · security.txt expired · privacy no · accessibility no | |
| uac.pt Universidade dos Acores | Portugal | PT | HTTP 200 · HSTS yes · security.txt expired · privacy no · accessibility no · GPTBot partly blocked | |
| ubi.pt Universidade da Beira Interior | Portugal | PT | HTTP 200 · HSTS no · security.txt expired · privacy no · accessibility no · GPTBot partly blocked | |
| ucalgary.ca University of Calgary | Canada | CA | HTTP 200 · HSTS yes · security.txt expired · privacy yes · accessibility no · GPTBot partly blocked | |
| ulaval.ca Université Laval | Canada | CA | HTTP 200 · HSTS no · security.txt expired · privacy no · accessibility no · GPTBot partly blocked | |
| umj.ac.id Universitas Muhammadiyah Jakarta | Indonesia | ID | HTTP 403 · HSTS yes · security.txt expired · privacy no · accessibility no | |
| unesp.br Universidade Estadual Paulista | Brazil | BR | HTTP 200 via www2.unesp.br · HSTS yes · security.txt expired · privacy no · accessibility no · GPTBot partly blocked | |
| unigre.it Pontifica Università Gregoriana | Italy | IT | HTTP 200 · HSTS yes · security.txt expired · privacy yes · accessibility no · GPTBot partly blocked | |
| unk.edu University of Nebraska, Kearney | United States | US | HTTP 200 · HSTS no · security.txt expired · privacy yes · accessibility yes | |
| unl.edu University of Nebraska, Lincoln | United States | US | HTTP 200 · HSTS no · security.txt expired · privacy yes · accessibility yes · GPTBot partly blocked | |
| uog.edu University of Guam | Guam | GU | HTTP 200 · HSTS yes · security.txt expired · privacy yes · accessibility yes | |
| uoguelph.ca University of Guelph | Canada | CA | HTTP 200 · HSTS no · security.txt expired · privacy no · accessibility no · GPTBot partly blocked |
The same rows as JSON: expired-security-txt.top.json (CORS open, cached one day).
Get the full list: 61 rows, 1.00 USDC
x402 on Base, paid per file, no account or key. GET https://universities.agentexchange.work/leads/expired-security-txt.csv or GET https://universities.agentexchange.work/leads/expired-security-txt.json answers 402 Payment Required with the terms (scheme exact, USDC on Base, maxAmountRequired 1000000, payTo 0xc91cE6291eDC0713ec753BAFBA002506ffb2b95c); an x402 client signs the EIP-3009 authorization and resends the same request with X-PAYMENT; the file comes back with a PAYMENT-RESPONSE header. HEAD gets the same 402. One country: GET https://universities.agentexchange.work/leads/expired-security-txt/state/<code>.csv, 0.25 USDC (codes in the table above).
curl -sS -D - https://universities.agentexchange.work/leads/expired-security-txt.csv # 402 with the x402 terms; pay and resend with X-PAYMENT
Columns (19): domain, name, type, city, state, known_domains, reachable, http_only, https_status, final_host, hsts, security_txt, privacy_link, accessibility_link, robots_gptbot, robots_chatgpt_user, robots_claude_user, llms_txt, title. CSV: header row, every cell quoted, yes/no for booleans. JSON: { list, title, count, by_state, columns, rows[][] }. Sizes: CSV 12 KB, JSON 14 KB. The same facts are in the free CC BY 4.0 dumps: the price buys the filtered, country-sliceable file built from the 2026-09-30 census, not exclusive data. Settlement is final; no refunds. Prices in /.well-known/x402 equal the challenges. Terms · pricing.
Card checkout for this list is not open yet; the x402 route works now.
Monitor this list (free)
Atom feed: universities that entered or left this list according to the live re-checks (every 6 hours a rotating slice, each domain at most once per 14 days; each entry says which way it moved and which field changed). expired-security-txt.top.json: the first 50 rows and the counts by country as JSON, CORS open. Fields watched: security_txt, security_txt.expired.
Membership reflects the homepage and well-known files as fetched on 2026-09-30: a control that exists but was not found where the census looked counts as missing, and sites answering 403 to our one polite request count as reachable. Every domain links to its record with what to fix, a JSON twin, a badge and a changes feed. Data licence CC BY 4.0. Not legal advice.