Serve security.txt as text/plain with utf-8 on Apache

Why it matters

RFC 9116 requires the file to be sent as text/plain in utf-8. Tools may reject it if the server labels it as html, binary or another charset.

The fix

1. Force the type and charset for the file in the virtual host (or in an .htaccess file inside .well-known, which needs AllowOverride FileInfo).
2. Reload Apache and check the Content-Type header again.

<Files "security.txt">
    ForceType text/plain
    AddDefaultCharset utf-8
</Files>

Read the documentation ↗(opens in a new tab)

Related

• Reported by the security.txt check
• Publish a security.txt file
• Serve security.txt from /.well-known/
• Serve security.txt over https
• Add a Contact line to security.txt
• Fix the Contact value in security.txt
• Add an Expires line to security.txt
• Use an RFC 3339 date in the Expires line
• Renew the expired security.txt
• Renew security.txt before it expires
• Shorten the security.txt Expires date
• Fix repeated or insecure fields in security.txt
• Make the Canonical line match where the file is served