README

WordPress plugin that serves /.well-known/security.txt (RFC 9116), maintained under Settings → security.txt.

Confirmed validity — Expires is one year after the details were last confirmed (built on mindtwo/base-security-txt). The form ends with the validity and two native buttons: Save Changes stores the fields and keeps the date, Confirm details stores them and renews the validity for one year. The very first save publishes the file. Nobody edits a date, and a file nobody confirms expires.
Reminder — from 30 days before expiry, administrators see a notice on every admin page with a Check now button that leads to the settings page.
Fields — Contact (required, one per line: e-mail, + phone number or https URL), Policy, Encryption, Acknowledgments, Hiring, Preferred languages. Canonical is added automatically on https sites.
Safe defaults — invalid input is rejected with a message and the published file stays unchanged; without a contact the URL answers 404. /security.txt redirects (301) to the well-known path.
Multisite — every site has its own settings and file.
English and German interface.

Installation

Classic WordPress without Composer (ZIP upload)

Every GitHub release carries a wordpress-security-txt-<version>.zip with the core bundled. Use that asset — the auto-generated "Source code (zip)" lacks vendor/ and leaves the plugin inactive.

Plugins → Add New → Upload Plugin, choose the ZIP, install and activate.
Settings → security.txt: enter the contact and save.

Composer-based WordPress

composer require mindtwo/wordpress-security-txt
wp plugin activate wordpress-security-txt

The project's vendor/autoload.php must be loaded before plugins run (Bedrock does this).

Requirements: WordPress 6.5+, PHP 8.0+, pretty permalinks (any structure except "Plain").

Notes

A physical file at .well-known/security.txt in the web root wins over the plugin; delete it.
Responses are sent with Cache-Control: public, max-age=3600, so a CDN or page cache shows changes within an hour at the latest.
Settings are stored in the option mindtwo_security_txt as ['data' => <Settings::toArray()>, 'confirmed_at' => <unix time>].

Development

composer install
composer check                 # pint --test, phpstan (level 8), pest
bin/build-zip.sh 1.0.0         # release ZIP into dist/

Inside the monorepo the core resolves through the path repository base-security-txt; CI removes it when the package is built standalone. For a local ZIP build before the core is released, set BASE_SECURITY_TXT_PATH=../base-security-txt.

License

MIT, see LICENSE.md.

mindtwo / wordpress-security-txt

Package info

Security

Statistics