call Contact
shield How-To

security.txt in TYPO3

A security.txt file makes it easy for security researchers to responsibly report vulnerabilities on your website to the right place – standardized under RFC 9116.

history Letzte Änderung: 21.08.2026

What Is security.txt?

security.txt is a standardized text document that website operators publish at /.well-known/security.txt. It works much like a robots.txt – just for security matters: if someone finds a vulnerability on your website, they don't have to search for a suitable contact; instead they immediately find a clearly defined way to make a responsible disclosure.

The format is standardized in RFC 9116 and is used by major providers such as Google, GitHub, and Cloudflare, among others.

Example of a security.txt

Here's what a minimal, RFC-compliant security.txt could look like:

Contact: mailto:info@wacon.de
Expires: 2027-08-21T00:00:00.000Z
Encryption: https://www.wacon.de/pgp-key.txt
Preferred-Languages: en, de
Canonical: https://www.wacon.de/.well-known/security.txt

description Fields

The Most Important Fields at a Glance

  • contact_mail

    Contact (required): At least one way to report security issues – e.g. an email address (mailto:) or a form link. Multiple Contact lines are allowed.

  • event_busy

    Expires (required): Date after which the file is considered outdated (ISO 8601 format). Without a current expiry date, the security.txt is considered non-compliant – renew it regularly!

  • vpn_key

    Encryption (optional): Link to a public PGP key, in case reports should be submitted encrypted.

  • gpp_good

    Acknowledgments (optional): Link to a page recognizing people who have responsibly reported vulnerabilities.

  • language

    Preferred-Languages (optional): Comma-separated list of languages in which reports are preferably received.

  • link

    Canonical (optional): The official URL of the security.txt itself – important if the file is additionally referenced or mirrored elsewhere.

  • policy

    Policy (optional): Link to a detailed vulnerability disclosure policy.

Adding security.txt to TYPO3

Since security.txt is a simple, static text file, integrating it into TYPO3 generally requires no additional TypoScript or extension:

  1. Create the file with your content in the TYPO3 installation directory at public/.well-known/security.txt – that's the location specified by RFC 9116.
  2. Optionally, you can also place a copy at public/security.txt to support older implementations that still look at the old path.
  3. Check that your web server or .htaccess configuration doesn't block access to /.well-known/. TYPO3's default .htaccess already accounts for this correctly and explicitly exempts /.well-known/ from the usual blocking of hidden directories (per RFC 5785).
  4. Test it directly in your browser at yourdomain.com/.well-known/security.txt – the file should be displayed as plain text.
event_busy

Remember to renew the Expires date regularly – it's best to set a recurring reminder, e.g. once a year as part of your next security check.

Germany's Federal Office for Information Security (BSI) generally recommends providing a security.txt and points out its still-low adoption (1.8% of website operators).

Interested in more security for your TYPO3 website?

We're happy to help you set up your security.txt and with further security measures.

chat Free Consultation