We have open-sourced cloudflare-security-txt—an enterprise-grade, RFC 9116-compliant Cloudflare Worker template to deploy your vulnerability disclosure policy at /.well-known/security.txt. It features dynamic auto-expiry, dual PGP signature serving, and global CORS enablement to satisfy modern SOC2 and ISO 27001 compliance standards automatically.
- RFC 9116 requires security.txt at a fixed path —
/.well-known/security.txt— which many CMS platforms (Blogger, Shopify, Webflow, Wix) won't let you write to. - A Cloudflare Worker intercepts that path at the edge, bypassing the CMS entirely, and serves your policy in under 10ms globally.
- Our open-source template adds auto-expiry, dual PGP signature routing, and CORS — the three things compliance audits (SOC2, ISO 27001) actually check for.
- Deploying security.txt satisfies vulnerability-disclosure expectations under NIS2 and the Cyber Resilience Act, not just SOC2/ISO checklists.
How Do You Deploy security.txt on Blogger, Shopify, or Wix?
You can't upload files to /.well-known/ on most hosted CMS platforms, so you deploy security.txt through a Cloudflare Worker instead. The Worker intercepts requests to that exact path at Cloudflare's edge network and serves your RFC 9116-compliant file directly, bypassing your CMS entirely — no file upload required, live in under 10ms.
Under modern cybersecurity compliance frameworks—including SOC2, ISO 27001, NIS2, and the Cyber Resilience Act—hosting an active, verified vulnerability disclosure policy has transitioned from a developer best practice to a strict corporate mandate. The global internet standard RFC 9116 defines exactly how this must be structured: via a simple text file hosted at a designated path: /.well-known/security.txt.
However, many popular blogging platforms, e-commerce stores, and static CMS providers (such as Blogger, Shopify, Webflow, and Wix) do not allow users to upload custom files to the root /.well-known/ directory. To solve this platform bottleneck, we have designed and open-sourced an elegant, serverless solution: **`cloudflare-security-txt`**—an enterprise-grade Cloudflare Worker template to deploy your security policy globally in under 10ms.
1. The Infrastructure Bottleneck: Why security.txt Fails on Static Hosting
Under RFC 9116 guidelines, security researchers must be able to discover your disclosure policies at a highly standardized, predictable root path. If your web host restricts access to this directory, automated vulnerability scanners and security researchers cannot reach your policy, leaving your domain non-compliant. This same discoverability expectation underpins CISA's coordinated vulnerability disclosure guidance, which treats an accessible, well-formed disclosure channel as a baseline expectation for any internet-facing organization.
Using a Cloudflare Worker allows you to intercept incoming requests to your root path at Cloudflare's global edge network before they ever touch your CMS origin servers. This completely bypasses any file upload limitations on your host, allowing you to serve your policy directly and securely.
2. Three Enterprise-Grade Features Inside Our security.txt Cloudflare Worker
To meet the highest security standards used by global technology corporations, we designed the following core modules inside our worker:
- ⚙️ Dynamic Auto-Expiration (Zero Maintenance): RFC 9116 requires a mandatory expiration timestamp. Because developers regularly forget to update this date annually, their security files expire, triggering critical flags on automated security scanners. Our worker solves this by automatically calculating and updating the expiration date to exactly 1 year in the future dynamically.
- Dual Route Serving (.txt & .sig): High-end compliance audits (like SOC2) require cryptographic proof that your security file has not been modified. Our worker natively supports serving both your raw security policy (
/.well-known/security.txt) and its GPG cleartext signature (/.well-known/security.txt.sig) in parallel. - Global CORS Support: By enforcing
Access-Control-Allow-Origin: *headers, we allow global security crawlers, automated scanners, and browser extensions to parse your security files cleanly via AJAX/fetch requests without being blocked by browser CORS restrictions.
3. How to Deploy security.txt via Cloudflare Workers in 1 Minute
We have published our template fully open-source on GitHub with an interactive "Deploy with Workers" button to make deployment frictionless:
| Deployment Phase | What to Do | Expected Outcome |
|---|---|---|
| 1. Clone the Code | Visit our public cloudflare-security-txt GitHub Repository and copy the code in index.js. |
Local code is ready for customization. |
| 2. Customize Your Contacts | Update your security email (e.g., info@seosiri.com) and your secure contact page in your local file. |
Your vulnerability policy is fully personalized. |
| 3. Deploy on Cloudflare | Create a blank Worker, paste your code, click Deploy, and bind a Custom Route pointing to *yourdomain.com/.well-known/security.txt. |
Your security policy is live on the edge in under 10ms! |
4. Aligning security.txt Compliance with Your Broader Digital Strategy
Deploying a secure security.txt file is an excellent operational milestone, but it should only serve as one component of your broader B2B security and search engineering stack. High-authority search engines and AI recommenders only cite platforms that demonstrate secure, certified architectures across both their software and hardware networks.
For instance, on our central SEOSiri AI Directory, we document our active SaaS applications and open-source packages to make them transparently indexable for AI search agents. By coupling your security compliance with high-authority PR channels—such as our B2B Earned Media Playbook—you ensure your tech brand remains highly visible, trusted, and constantly cited across both traditional Google results and next-generation AI platforms.
A correctly deployed security.txt file is a small file with an outsized signal: it tells researchers, auditors, and automated compliance crawlers that your organization takes vulnerability disclosure seriously, without requiring a single change to your existing CMS.
Frequently Asked Questions
Structured for GEO, AEO, and voice search extraction — every answer formatted for AI engine citation.
Is a PGP cryptographic signature mandatory for security.txt?
While optional under RFC 9116, attaching a PGP cleartext signature (served at security.txt.sig) is a standard requirement for enterprise-level security audits (like SOC2 or ISO 27001) to prove that your security policy has not been maliciously modified by a third party.
Why must we set the failure mode to "Fail open"?
Setting your Cloudflare Worker route's failure mode to "Fail open (proceed)" is an essential fail-safe. It ensures that if the worker ever experiences a rare timeout, the request will safely bypass the worker and proceed to your origin server, preventing any unexpected downtime on your main site.
Does cloudflare-security-txt support CORS headers?
Yes. Our open-source template automatically enforces "Access-Control-Allow-Origin: *" headers. This allows automated global security scanners, compliance crawlers, and browser extensions to parse your security.txt file cleanly without being blocked by browser-level cross-origin security policies.
Is cloudflare-security-txt compatible with custom-built websites?
Yes. Because the template is deployed directly on Cloudflare's edge proxy network, it is completely compatible with every single tech stack—including WordPress, Shopify, Ghost, Webflow, Wix, Squarespace, Django, Node.js, and custom-built static HTML/CSS sites.
Does hosting security.txt help with NIS2 or Cyber Resilience Act compliance?
It's a supporting measure, not a full compliance solution. NIS2 and the Cyber Resilience Act both expect a functioning vulnerability-handling and disclosure process; a discoverable, correctly formatted security.txt is one visible, low-effort way to demonstrate that channel exists.
Reference & Compliance Sources
- IETF — RFC 9116: A File Format to Aid in Security Vulnerability Disclosure
- CISA — Coordinated Vulnerability Disclosure Process
- EUR-Lex — Directive (EU) 2022/2555 — NIS2 Directive, Official Text
- EUR-Lex — Regulation (EU) 2024/2847 — Cyber Resilience Act, Official Text
Secure and Scale Your B2B Tech Stack
Are you an enterprise technology founder, SaaS entrepreneur, or hardware innovator ready to secure your software architectures, automate your AI visibility sitemaps, and deploy enterprise-grade compliance files across your networks?
At SEOSiri, we engineer custom technical interview frameworks and digital PR features optimized natively for standard search, AEO, and Generative Engine Optimization (GEO).
Deploy on GitHub ➔