Serve security.txt over https

Why it matters

RFC 9116 requires security.txt to be served over https, because a file read over plain http can be altered on the way and send reports to an attacker. Researchers' tools may ignore a file that only exists on http.

The fix

1. Make sure example.com has a working https certificate (see the TLS fixes for this scan if it does not).
2. Serve the file at https://example.com/.well-known/security.txt and make sure no rule redirects https requests for it back to http.
3. Redirect http requests to https for the whole site so the plain http address also ends up at the https file.
4. If the site is behind Cloudflare or another CDN that connects to this server over plain http (Cloudflare Flexible mode), this redirect loops. Switch the CDN to Full (strict) first, or redirect at the CDN instead (Always Use HTTPS).

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the security.txt check
• Publish a security.txt file
• Serve security.txt from /.well-known/
• Serve security.txt as text/plain with utf-8
• Add a Contact line to security.txt
• Fix the Contact value in security.txt
• Add an Expires line to security.txt
• Use an RFC 3339 date in the Expires line
• Renew the expired security.txt
• Renew security.txt before it expires
• Shorten the security.txt Expires date
• Fix repeated or insecure fields in security.txt
• Make the Canonical line match where the file is served