Add an Expires line to security.txt on Cloudflare

Why it matters

Expires is required by RFC 9116 so that an old file with a mailbox nobody reads is not trusted forever. Without it the file is invalid.

The fix

1. If the file is managed in Cloudflare, open Security, Settings, Web application exploits, Security.txt, Configurations, and set the Expires at field, then Save.
2. Renew the date before it passes.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the security.txt check
• Publish a security.txt file
• Serve security.txt from /.well-known/
• Serve security.txt over https
• Serve security.txt as text/plain with utf-8
• Add a Contact line to security.txt
• Fix the Contact value in security.txt
• Use an RFC 3339 date in the Expires line
• Renew the expired security.txt
• Renew security.txt before it expires
• Shorten the security.txt Expires date
• Fix repeated or insecure fields in security.txt
• Make the Canonical line match where the file is served