Fix the Contact value in security.txt on Cloudflare

Why it matters

RFC 9116 allows a Contact only as a mailto:, tel: or https:// address, so a bare email address or an http link is not valid. Tools that read the file may skip such a line.

The fix

1. If the file is managed in Cloudflare, open Security, Settings, Web application exploits, Security.txt, Configurations, and correct the Contact field.
2. Use the mailto:, tel: or https:// prefix and Save.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the security.txt check
• Publish a security.txt file
• Serve security.txt from /.well-known/
• Serve security.txt over https
• Serve security.txt as text/plain with utf-8
• Add a Contact line to security.txt
• Add an Expires line to security.txt
• Use an RFC 3339 date in the Expires line
• Renew the expired security.txt
• Renew security.txt before it expires
• Shorten the security.txt Expires date
• Fix repeated or insecure fields in security.txt
• Make the Canonical line match where the file is served