How to create a security.txt

Hey community,

I am trying to implement a security.txt file following the RFC RFC 9116: A File Format to Aid in Security Vulnerability Disclosure

Sadly I can’t create the path “.well-known”, since the dot get’s escaped and I am also unsure how to place the security.txt file, which I uploaded to the assets, within directory.

Has someone already done this? Until now I sadly only found entries that this is possible, but from multiple years ago but I would expect a major website platform like webflow supports the official RFCs.

Many thanks in advance!

Try a redirect. It will depend on the system reading the security.txt, but it may work smoothly.

Many thanks for the proposal, sadly this only leads to a response stating

Invalid .well-known request

when trying to access the redirect. I have seen workarounds using javascript, but this kinda defeats the purpose of having a machine-readable .txt-file for security :confused:

It’s a heavier lift, but if this is an important need for your site, the way I solve this for clients is by building it out using a reverse proxy. That makes it possible to add any files/folders at any path you need, and it’s possible to update them as well.

Many thanks for the suggestion!

While I understand the technical solution, this kinda defeats the purpose of going with a managed service for hosting my website. If I get a server, deploy a reverse-proxy etc. I could also simply host my website there.

Is there anything planned by webflow to enable this feature, e.g. an open issue which could be checked?

You don’t need a server, and WF sites don’t re-host easily, particularly if you’re using the CMS, ECom, User accounts, etc.

Cloudflare is popular for RP’s because, a basic setup like this one ( deliver files at specific paths ) works great on the free plan.
It’s a fairly technical setup though, so non-devs usually need to hire someone for the initial build.

There are some other services like Subfold, however they come with a monthly fee that adds up quickly.

Check the Webflow wishlist ( wishlist.webflow.com ), I’m sure someone has an item there you can upvote.