WP Manifestindependent plugin directory
manifest / security / wordpress-security-txt

mindtwo security.txt

WordPress plugin that serves an RFC 9116 security.txt maintained under Settings, with an expiry that follows the last save.

by mindtwo GmbH · github.com/mindtwo/wordpress-security-txt · website

★ 0stars
6composer installs

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/mindtwo/wordpress-security-txt/archive/refs/heads/main.zip

On Packagist as mindtwo/wordpress-security-txt:

composer require mindtwo/wordpress-security-txt
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/mindtwo/wordpress-security-txt ↗

mindtwo/wordpress-security-txt

WordPress plugin that serves /.well-known/security.txt (RFC 9116), maintained under Settings → security.txt.

  • Confirmed validity — Expires is one year after the details were last confirmed (built on mindtwo/base-security-txt). The form ends with the validity and two native buttons: Save Changes stores the fields and keeps the date, Confirm details stores them and renews the validity for one year. The very first save publishes the file. Nobody edits a date, and a file nobody confirms expires.
  • Reminder — from 30 days before expiry, administrators see a notice on every admin page with a Check now button that leads to the settings page.
  • Fields — Contact (required, one per line: e-mail, + phone number or https URL), Policy, Encryption, Acknowledgments, Hiring, Preferred languages. Canonical is added automatically on https sites.
  • Safe defaults — invalid input is rejected with a message and the published file stays unchanged; without a contact the URL answers 404. /security.txt redirects (301) to the well-known path.
  • Multisite — every site has its own settings and file.
  • English and German interface.

Installation

Classic WordPress without Composer (ZIP upload)

Every GitHub release carries a wordpress-security-txt-<version>.zip with the core bundled. Use that asset — the auto-generated "Source code (zip)" lacks vendor/ and leaves the plugin inactive.

  1. Plugins → Add New → Upload Plugin, choose the ZIP, install and activate.
  2. Settings → security.txt: enter the contact and save.

Composer-based WordPress

composer require mindtwo/wordpress-security-txt
wp plugin activate wordpress-security-txt

The project's vendor/autoload.php must be loaded before plugins run (Bedrock does this).

Requirements: WordPress 6.5+, PHP 8.0+, pretty permalinks (any structure except "Plain").

Notes

  • A physical file at .well-known/security.txt in the web root wins over the plugin; delete it.
  • Responses are sent with Cache-Control: public, max-age=3600, so a CDN or page cache shows changes within an hour at the latest.
  • Settings are stored in the option mindtwo_security_txt as ['data' => <Settings::toArray()>, 'confirmed_at' => <unix time>].

Development

composer install
composer check                 # pint --test, phpstan (level 8), pest
bin/build-zip.sh 1.0.0         # release ZIP into dist/

Inside the monorepo the core resolves through the path repository base-security-txt; CI removes it when the package is built standalone. For a local ZIP build before the core is released, set BASE_SECURITY_TXT_PATH=../base-security-txt.

License

MIT, see LICENSE.md.