Serve security.txt over https on Apache

Why it matters

RFC 9116 requires security.txt to be served over https, because a file read over plain http can be altered on the way and send reports to an attacker. Researchers' tools may ignore a file that only exists on http.

The fix

1. Add a redirect in the port 80 virtual host that sends every request to https, and serve the file from the port 443 virtual host.
2. If the site is behind Cloudflare or another CDN that connects to this server over plain http (Cloudflare Flexible mode), this redirect loops. Switch the CDN to Full (strict) first, or redirect at the CDN instead (Always Use HTTPS).
3. Reload Apache and open https://example.com/.well-known/security.txt.

<VirtualHost *:80>
    ServerName example.com
    Redirect permanent / https://example.com/
</VirtualHost>

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the security.txt check
• Publish a security.txt file
• Serve security.txt from /.well-known/
• Serve security.txt as text/plain with utf-8
• Add a Contact line to security.txt
• Fix the Contact value in security.txt
• Add an Expires line to security.txt
• Use an RFC 3339 date in the Expires line
• Renew the expired security.txt
• Renew security.txt before it expires
• Shorten the security.txt Expires date
• Fix repeated or insecure fields in security.txt
• Make the Canonical line match where the file is served