Publish a security.txt file on Apache

Why it matters

A security.txt file tells researchers who to contact when they find a security problem on your site, so a report reaches you instead of being posted publicly or lost. It is a small plain text file defined in RFC 9116.

The fix

1. Create .well-known/security.txt inside the DocumentRoot of example.com with the content shown in the generic tab.
2. Check that no rule blocks paths starting with a dot. A rule such as RedirectMatch 404 /\. also hides .well-known; change it to RedirectMatch 404 /\.(?!well-known/) so that folder stays reachable.
3. Reload Apache and open https://example.com/.well-known/security.txt. Apache serves .txt files as text/plain; if the charset is missing, add the Files block from the snippet, which sets utf-8 for this one file only.

# Only needed if you hide dotfiles; this keeps /.well-known/ reachable
RedirectMatch 404 /\.(?!well-known/)

# Only needed if the charset is missing
<Files "security.txt">
    AddDefaultCharset utf-8
</Files>

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the security.txt check
• Serve security.txt from /.well-known/
• Serve security.txt over https
• Serve security.txt as text/plain with utf-8
• Add a Contact line to security.txt
• Fix the Contact value in security.txt
• Add an Expires line to security.txt
• Use an RFC 3339 date in the Expires line
• Renew the expired security.txt
• Renew security.txt before it expires
• Shorten the security.txt Expires date
• Fix repeated or insecure fields in security.txt
• Make the Canonical line match where the file is served