Serve a security.txt File
Publishes /.well-known/security.txt so security researchers know how to report a vulnerability on your site responsibly.
Opens WPIDE on
Code
$wpide_security_txt = array(
'Contact' => 'mailto:[email protected]',
'Preferred-Languages' => 'en',
'Policy' => home_url( '/security-policy/' ),
);
add_action( 'init', function () use ( $wpide_security_txt ) {
$path = isset( $_SERVER['REQUEST_URI'] ) ? (string) wp_parse_url( wp_unslash( $_SERVER['REQUEST_URI'] ), PHP_URL_PATH ) : '';
$base = rtrim( (string) wp_parse_url( home_url(), PHP_URL_PATH ), '/' );
if ( $path !== $base . '/.well-known/security.txt' ) {
return;
}
$lines = array();
foreach ( $wpide_security_txt as $field => $value ) {
$lines[] = $field . ': ' . str_replace( array( "\r", "\n" ), '', wp_strip_all_tags( (string) $value ) );
}
$lines[] = 'Expires: ' . gmdate( 'Y-m-d\TH:i:s\Z', time() + 180 * DAY_IN_SECONDS );
$lines[] = 'Canonical: ' . home_url( '/.well-known/security.txt' );
status_header( 200 );
header( 'Content-Type: text/plain; charset=utf-8' );
echo implode( "\n", $lines ) . "\n"; // phpcs:ignore WordPress.Security.EscapeOutput -- plain text response.
exit;
} );Notes
If your web server answers /.well-known/ itself, place a static file there instead.
How to add this snippet
- Install WPIDE on your WordPress site (it is free) and open Code Snippets.
- Use snippet above adds it from the library in one click. Or copy the code into a new snippet with the same code type.
- It is added inactive: review the code and settings, then switch it on.