Serve security.txt as text/plain with utf-8 on Netlify

Why it matters

RFC 9116 requires the file to be sent as text/plain in utf-8. Tools may reject it if the server labels it as html, binary or another charset.

The fix

1. Netlify sets Content-Type from the file extension, so serve a real static file named security.txt at .well-known/security.txt. To force the type, add a _headers rule for /.well-known/security.txt with Content-Type: text/plain; charset=utf-8. Custom headers do not apply to functions or proxied responses.
2. A rewrite such as /* /index.html 200 does not override an existing file, but a rule with force enabled does; remove force from any catch-all rule, then redeploy and check the response again.

/.well-known/security.txt
  Content-Type: text/plain; charset=utf-8

Read the documentation ↗(opens in a new tab)

Related

• Reported by the security.txt check
• Publish a security.txt file
• Serve security.txt from /.well-known/
• Serve security.txt over https
• Add a Contact line to security.txt
• Fix the Contact value in security.txt
• Add an Expires line to security.txt
• Use an RFC 3339 date in the Expires line
• Renew the expired security.txt
• Renew security.txt before it expires
• Shorten the security.txt Expires date
• Fix repeated or insecure fields in security.txt
• Make the Canonical line match where the file is served