Serve security.txt as text/plain with utf-8 on Cloudflare

Why it matters

RFC 9116 requires the file to be sent as text/plain in utf-8. Tools may reject it if the server labels it as html, binary or another charset.

The fix

1. Cloudflare passes the origin's Content-Type through, so fix it at the origin using the tab for your server.
2. If you use Cloudflare's managed security.txt (Security, Settings, Web application exploits, Security.txt) and the type is still wrong, check whether a rule or Worker on the zone is rewriting that path.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the security.txt check
• Publish a security.txt file
• Serve security.txt from /.well-known/
• Serve security.txt over https
• Add a Contact line to security.txt
• Fix the Contact value in security.txt
• Add an Expires line to security.txt
• Use an RFC 3339 date in the Expires line
• Renew the expired security.txt
• Renew security.txt before it expires
• Shorten the security.txt Expires date
• Fix repeated or insecure fields in security.txt
• Make the Canonical line match where the file is served