Serve security.txt from /.well-known/ on Caddy

Why it matters

RFC 9116 puts the file at /.well-known/security.txt and keeps /security.txt only for older setups. Researchers and tools look in the standard place first.

The fix

1. Add a rewrite to the site block of example.com so the standard address serves the existing file, before your file_server or proxy lines.
2. If the site is behind reverse_proxy, the rewrite only changes the path that is sent to the application, so the application itself must serve /security.txt. Otherwise serve the file with file_server, as in the security.txt fix.
3. Run caddy reload and open https://example.com/.well-known/security.txt.

example.com {
	rewrite /.well-known/security.txt /security.txt
	# keep the rest of your site configuration here
}

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the security.txt check
• Publish a security.txt file
• Serve security.txt over https
• Serve security.txt as text/plain with utf-8
• Add a Contact line to security.txt
• Fix the Contact value in security.txt
• Add an Expires line to security.txt
• Use an RFC 3339 date in the Expires line
• Renew the expired security.txt
• Renew security.txt before it expires
• Shorten the security.txt Expires date
• Fix repeated or insecure fields in security.txt
• Make the Canonical line match where the file is served