Serve security.txt over https on Cloudflare
Why it matters
RFC 9116 requires security.txt to be served over https, because a file read over plain http can be altered on the way and send reports to an attacker. Researchers' tools may ignore a file that only exists on http.
The fix
- In SSL/TLS, Edge Certificates, turn on Always Use HTTPS so http requests are redirected to https at Cloudflare's edge.
- Check that the hostname is proxied and that the SSL/TLS mode is not Flexible, which talks to your origin over plain http. Use Full (strict) with a valid origin certificate.
Related
- Reported by the security.txt check
- Publish a security.txt file
- Serve security.txt from /.well-known/
- Serve security.txt as text/plain with utf-8
- Add a Contact line to security.txt
- Fix the Contact value in security.txt
- Add an Expires line to security.txt
- Use an RFC 3339 date in the Expires line
- Renew the expired security.txt
- Renew security.txt before it expires
- Shorten the security.txt Expires date
- Fix repeated or insecure fields in security.txt
- Make the Canonical line match where the file is served
Scan your domain to see whether this applies to you.