mindtwo / craftcms-security-txt

v1.0.0 2026-11-05 11:49 UTC

Requires

• php: ^8.0.2
• craftcms/cms: ^4.0|^5.0
• mindtwo/base-security-txt: ^1.0

Requires (Dev)

• laravel/pint: ^1.13
• pestphp/pest: ^2.34|^3.0|^4.0
• phpstan/phpstan: ^1.11|^2.0

MIT

• mindtwo GmbH

• security
• craftcms
• craft-plugin
• security.txt
• mindtwo
• rfc9116
• nis2

Published on Packagist.org on 2026-11-05 11:55 UTC

README

Craft CMS plugin that serves /.well-known/security.txt (RFC 9116) per site, maintained in the control panel under security.txt.

• Confirmed validity — Expires is one year after the details were last confirmed (built on mindtwo/base-security-txt). The form ends with the validity and a Confirm details button that stores the fields and renews the validity for one year; Save changes in the header stores them and keeps the date. The very first save publishes the file. Nobody edits a date, and a file nobody confirms expires.
• Reminder — from 30 days before expiry, users with access see a control panel alert on every page with a Check now link to the security.txt page.
• Editable in production — the content lives in the plugin's own table, not in project config, so it works with allowAdminChanges disabled. Access is granted with the regular Access security.txt user permission.
• Fields — Contact (required, one per line: e-mail, + phone number or https URL), Policy, Encryption, Acknowledgments, Hiring, Preferred languages. Canonical is added automatically on https sites.
• Safe defaults — invalid input is rejected with field errors and the published file stays unchanged; without a contact the URL answers 404. /security.txt redirects (301) to the well-known path.
• Multi-site — one file per site, with a site switcher in the control panel.
• English and German interface.

Installation

composer require mindtwo/craftcms-security-txt
php craft plugin/install mindtwo-security-txt

Then open security.txt in the control panel, enter the contact and save.

Requirements: Craft CMS 4 or 5, PHP 8.0.2+.

Notes

• A route for .well-known/security.txt or security.txt in config/routes.php wins over the plugin. When switching from such a project-level solution, remove the route after entering the contact in the plugin.
• Responses are sent with Cache-Control: public, max-age=3600, so a CDN shows changes within an hour at the latest.

Development

composer install
composer check   # pint --test, phpstan (level 8), pest

Inside the monorepo the core resolves through the path repository base-security-txt; CI removes it when the package is built standalone.

License

MIT, see LICENSE.md.