Upon enabling this and filling the input fields with the data and saving, you can access it, edit or download as follows:
If you’d like to have it accessible as https://example.com/.well-known/security.txt
, you can use Worker which is bound and routed to that path and which returns the needed/required.
Create a Worker in a Dashboard using 6 steps on the article below, navigate via the direct link here → https://dash.cloudflare.com/?to=/:account/workers-and-pages/create.
Give it a name and click on the “Edit code” button.

From the left side interface, delete all the code and write or copy-paste below code example in the left interface to have it empty/cleared.
Furthermore, using code below for a Worker, make sure to copy the content from your downloaded Security.txt
from Security tab on Cloudflare dashboard, paste it into the part let securitytxt = ``:
, inside the single quotes ``
Replace example.com
with your real domain name:
addEventListener('fetch', event => {
event.respondWith(handleRequest(event.request))
})
let securitytxt = `Contact: mailto:[email protected]
Expires: 2031-12-31T11:59:00Z
Preferred-Languages: hr, en
Canonical: https://example.com/.well-known/security.txt`;
async function handleRequest(request) {
return new Response(
securitytxt,
{
status: 200,
headers: {
'strict-transport-security': "max-age=30",
'expect-ct': "max-age=30, enforce"
}
}
)
}
Navigate to the Worker Routes under your zone and click on “Add Route” button, direct link → https://dash.cloudflare.com/?to=/:account/:zone/workers:
Write the Route as follows on below (replace example.com
with your real domain name), that way you’d bound it to the path and select your securitytxt
worker from the dropdown menu and click “Save”:
For for a minute and try to access this path you’ve configured.
Related article: