Serve security.txt over https on Caddy
Why it matters
RFC 9116 requires security.txt to be served over https, because a file read over plain http can be altered on the way and send reports to an attacker. Researchers' tools may ignore a file that only exists on http.
The fix
- Caddy enables https and redirects http to https automatically for a site address with a public hostname. Make sure the site block uses the hostname without an http:// prefix, and that ports 80 and 443 reach Caddy.
- If the site is behind Cloudflare or another CDN that connects to this server over plain http (Cloudflare Flexible mode), this redirect loops. Switch the CDN to Full (strict) first, or redirect at the CDN instead (Always Use HTTPS).
- Reload Caddy and open https://example.com/.well-known/security.txt.
The examples use example.com. Replace it with your own domain.
Related
- Reported by the security.txt check
- Publish a security.txt file
- Serve security.txt from /.well-known/
- Serve security.txt as text/plain with utf-8
- Add a Contact line to security.txt
- Fix the Contact value in security.txt
- Add an Expires line to security.txt
- Use an RFC 3339 date in the Expires line
- Renew the expired security.txt
- Renew security.txt before it expires
- Shorten the security.txt Expires date
- Fix repeated or insecure fields in security.txt
- Make the Canonical line match where the file is served
Scan your domain to see whether this applies to you.