Serve security.txt over https on nginx

Why it matters

RFC 9116 requires security.txt to be served over https, because a file read over plain http can be altered on the way and send reports to an attacker. Researchers' tools may ignore a file that only exists on http.

The fix

1. Keep one server block that listens on port 80 only to redirect to https, and serve the file from the https server block.
2. If the site is behind Cloudflare or another CDN that connects to this server over plain http (Cloudflare Flexible mode), this redirect loops. Switch the CDN to Full (strict) first, or redirect at the CDN instead (Always Use HTTPS).
3. Run nginx -t, reload nginx and open https://example.com/.well-known/security.txt.

server {
    listen 80;
    server_name example.com;
    return 301 https://$host$request_uri;
}

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the security.txt check
• Publish a security.txt file
• Serve security.txt from /.well-known/
• Serve security.txt as text/plain with utf-8
• Add a Contact line to security.txt
• Fix the Contact value in security.txt
• Add an Expires line to security.txt
• Use an RFC 3339 date in the Expires line
• Renew the expired security.txt
• Renew security.txt before it expires
• Shorten the security.txt Expires date
• Fix repeated or insecure fields in security.txt
• Make the Canonical line match where the file is served