Make the Canonical line match where the file is served

Why it matters

The Canonical line lists the addresses where this file officially lives, and a file read from an address that is not listed is treated with suspicion. Copied or moved files often keep the old address.

The fix

1. Set the Canonical line to the exact address you serve the file from. If the file is served from several hostnames (for example with and without www), add one Canonical line for each.
2. Or remove the Canonical line if you do not need it; it is optional.

Canonical: https://example.com/.well-known/security.txt

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the security.txt check
• Publish a security.txt file
• Serve security.txt from /.well-known/
• Serve security.txt over https
• Serve security.txt as text/plain with utf-8
• Add a Contact line to security.txt
• Fix the Contact value in security.txt
• Add an Expires line to security.txt
• Use an RFC 3339 date in the Expires line
• Renew the expired security.txt
• Renew security.txt before it expires
• Shorten the security.txt Expires date
• Fix repeated or insecure fields in security.txt