Publish a security.txt file on Netlify

Why it matters

A security.txt file tells researchers who to contact when they find a security problem on your site, so a report reaches you instead of being posted publicly or lost. It is a small plain text file defined in RFC 9116.

The fix

1. Add the file to the folder Netlify publishes (often public/ or dist/, or the repository root for a plain static site) as .well-known/security.txt.
2. Deploy from Git. Folders that start with a dot can get lost on the way to the deploy, for example in a CI step that copies or uploads build output without hidden files, or in a build tool that skips them; open https://example.com/.well-known/security.txt after the deploy to be sure.
3. If the dot folder is stripped, place the file in a folder named well-known and add this line to _redirects, which serves it at the standard address: /.well-known/* /well-known/:splat 200
4. Netlify sets Content-Type from the file extension, so a file named security.txt is sent as text/plain. To force the charset, add a _headers rule for /.well-known/security.txt with Content-Type: text/plain; charset=utf-8.

Contact: mailto:security@example.com
Expires: 2026-12-31T23:59:59Z
Preferred-Languages: en
Canonical: https://example.com/.well-known/security.txt

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the security.txt check
• Serve security.txt from /.well-known/
• Serve security.txt over https
• Serve security.txt as text/plain with utf-8
• Add a Contact line to security.txt
• Fix the Contact value in security.txt
• Add an Expires line to security.txt
• Use an RFC 3339 date in the Expires line
• Renew the expired security.txt
• Renew security.txt before it expires
• Shorten the security.txt Expires date
• Fix repeated or insecure fields in security.txt
• Make the Canonical line match where the file is served