# Serve a security.txt File

> Publishes /.well-known/security.txt so security researchers know how to report a vulnerability on your site responsibly.

- Type: PHP
- Runs: Frontend only
- Category: [Security](https://wpide.com/library/category/security/)
- Tags: security, disclosure, standards
- Author: WPIDE Team
- Installs: 0
- Updated: 2026-10-28
- Page: https://wpide.com/library/serve-security-txt/

## Code

```php
$wpide_security_txt = array(
    'Contact'             => 'mailto:security@example.com',
    'Preferred-Languages' => 'en',
    'Policy'              => home_url( '/security-policy/' ),
);

add_action( 'init', function () use ( $wpide_security_txt ) {
    $path = isset( $_SERVER['REQUEST_URI'] ) ? (string) wp_parse_url( wp_unslash( $_SERVER['REQUEST_URI'] ), PHP_URL_PATH ) : '';
    $base = rtrim( (string) wp_parse_url( home_url(), PHP_URL_PATH ), '/' );

    if ( $path !== $base . '/.well-known/security.txt' ) {
        return;
    }

    $lines = array();
    foreach ( $wpide_security_txt as $field => $value ) {
        $lines[] = $field . ': ' . str_replace( array( "\r", "\n" ), '', wp_strip_all_tags( (string) $value ) );
    }
    $lines[] = 'Expires: ' . gmdate( 'Y-m-d\TH:i:s\Z', time() + 180 * DAY_IN_SECONDS );
    $lines[] = 'Canonical: ' . home_url( '/.well-known/security.txt' );

    status_header( 200 );
    header( 'Content-Type: text/plain; charset=utf-8' );
    echo implode( "\n", $lines ) . "\n"; // phpcs:ignore WordPress.Security.EscapeOutput -- plain text response.
    exit;
} );
```

## Notes

If your web server answers /.well-known/ itself, place a static file there instead.

## How to use it

Install the free WPIDE plugin (https://wordpress.org/plugins/wpide/), find "Serve a security.txt File" in its snippet library and add it in one click; or create a new PHP snippet in WPIDE (or any code snippets plugin) and paste the code above. More snippets: https://wpide.com/library/