Add a Contact line to security.txt on Cloudflare

Why it matters

Contact is the one field that makes the file useful, because it says where to send a report. Without it the file is invalid under RFC 9116.

The fix

1. If the file is managed in Cloudflare, open Security, Settings, Web application exploits, Security.txt, Configurations, and edit the Contact field.
2. Use a mailto:, tel: or https:// value, then Save.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the security.txt check
• Publish a security.txt file
• Serve security.txt from /.well-known/
• Serve security.txt over https
• Serve security.txt as text/plain with utf-8
• Fix the Contact value in security.txt
• Add an Expires line to security.txt
• Use an RFC 3339 date in the Expires line
• Renew the expired security.txt
• Renew security.txt before it expires
• Shorten the security.txt Expires date
• Fix repeated or insecure fields in security.txt
• Make the Canonical line match where the file is served