Serve security.txt from /.well-known/ on Apache

Why it matters

RFC 9116 puts the file at /.well-known/security.txt and keeps /security.txt only for older setups. Researchers and tools look in the standard place first.

The fix

1. Add an Alias in the virtual host of example.com that maps the standard address to the existing file, and make sure the file's directory is readable by Apache.
2. If the file lives outside the DocumentRoot, Apache also needs permission for that folder. Uncomment the Directory block in the snippet and put the real folder in it.
3. Reload Apache and open https://example.com/.well-known/security.txt.

Alias /.well-known/security.txt /var/www/html/security.txt

# Only if the file is outside the DocumentRoot, allow its folder too:
# <Directory /srv/security>
#     Require all granted
# </Directory>

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the security.txt check
• Publish a security.txt file
• Serve security.txt over https
• Serve security.txt as text/plain with utf-8
• Add a Contact line to security.txt
• Fix the Contact value in security.txt
• Add an Expires line to security.txt
• Use an RFC 3339 date in the Expires line
• Renew the expired security.txt
• Renew security.txt before it expires
• Shorten the security.txt Expires date
• Fix repeated or insecure fields in security.txt
• Make the Canonical line match where the file is served