Publish a security.txt file on Cloudflare

Why it matters

A security.txt file tells researchers who to contact when they find a security problem on your site, so a report reaches you instead of being posted publicly or lost. It is a small plain text file defined in RFC 9116.

The fix

1. In the Cloudflare dashboard open Security, then Settings, filter by Web application exploits, and find Security.txt. Open Configurations and select the edit icon.
2. Enter at least one Contact (use a mailto:, tel: or https:// value) and an Expires date less than a year ahead. Add Canonical, Policy or Preferred-Languages if you want them, then Save.
3. Cloudflare serves the file at /.well-known/security.txt for hostnames that are proxied through it. Open https://example.com/.well-known/security.txt to confirm. If the hostname is not proxied, serve the file from your origin instead (see the other tabs).

Contact: mailto:[email protected]
Expires: 2026-12-31T23:59:59Z
Preferred-Languages: en
Canonical: https://example.com/.well-known/security.txt

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the security.txt check
• Serve security.txt from /.well-known/
• Serve security.txt over https
• Serve security.txt as text/plain with utf-8
• Add a Contact line to security.txt
• Fix the Contact value in security.txt
• Add an Expires line to security.txt
• Use an RFC 3339 date in the Expires line
• Renew the expired security.txt
• Renew security.txt before it expires
• Shorten the security.txt Expires date
• Fix repeated or insecure fields in security.txt
• Make the Canonical line match where the file is served