--- title: Django: serve a security.txt file | daily.dev description: A step-by-step guide shows how to serve a standards-compliant security.txt file (per RFC 9116) from a Django application, including a view with proper... canonical: https://daily.dev/posts/django-serve-a-security-txt-file-czhcqnylj twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Django: serve a security.txt file | daily.dev og:description: A step-by-step guide shows how to serve a standards-compliant security.txt file (per RFC 9116) from a Django application, including a view with proper... og:url: https://daily.dev/posts/django-serve-a-security-txt-file-czhcqnylj og:image: https://api.daily.dev/og/posts/CZHcQNylj.png og:image:alt: Django: serve a security.txt file og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Django: serve a security.txt file **[Adam Johnson](https://daily.dev/sources/adamj)** · 8 min read · 0 upvotes · 0 comments ## Summary A step-by-step guide shows how to serve a standards-compliant security.txt file (per RFC 9116) from a Django application, including a view with proper content-type and caching headers, a URLconf entry, unit tests covering the response and HTTP methods, and a custom Django system check that warns when the file's Expires field is nearing or past its date. The security.txt file gives researchers a clear way to report vulnerabilities, avoiding guesswork or public disclosure. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I serve a security.txt file in Django with the correct content type? Create a view using FileResponse that sets content_type to "text/plain; charset=utf-8", decorate it with @require_safe to limit it to GET and HEAD, and optionally @login_not_required and @cache_control for public caching. Wire it to the URL path ".well-known/security.txt" in the root URLconf so it's reachable at /.well-known/security.txt as required by RFC 9116. _daily.dev surfaces practical Django security patterns like this for developers hardening their sites._ ### What fields are required in a security.txt file per RFC 9116? Only two fields are required: Contact, a URI such as a mailto: address, https: URL, or tel: number telling researchers how to reach you; and Expires, an RFC 3339 timestamp after which the file should be considered stale, which must appear exactly once and is recommended to be set less than a year in the future. _Developers publishing a security contact policy can track standards details like this on daily.dev._ ### How can I make Django warn me when my security.txt Expires date is about to lapse? Register a custom Django system check that parses the Expires field from the security.txt file, computes the remaining time until expiry, and returns a checks.Warning if less than 30 days remain or a second warning if more than 365 days remain (violating the RFC's under-a-year recommendation). System checks run automatically on commands like runserver, migrate, and test, so the warning surfaces without blocking work. _daily.dev helps developers keeping maintenance tasks like expiry checks from slipping through the cracks._ ## Similar posts on daily.dev - [RFC 9116: security.txt for your PHP apps – DerEuroMark](https://daily.dev/posts/rfc-9116-security-txt-for-your-php-apps-dereuromark-zhcfsff4k) · DerEuroMark · 3 upvotes · 1 comments - [Secure File Upload System](https://daily.dev/posts/secure-file-upload-system-kwux4arbu) · Medium · 0 upvotes · 0 comments - [Django: serve apple-app-site-association and assetlinks.json](https://daily.dev/posts/django-serve-apple-app-site-association-and-assetlinks-json-gfshatk6j) · Adam Johnson · 0 upvotes · 1 comments - [Storing Django Static and Media Files on Cloudflare R2](https://daily.dev/posts/storing-django-static-and-media-files-on-cloudflare-r2-xmvnxyn8f) · TestDriven.io · 0 upvotes · 0 comments - [Django security releases issued: 6.0.5 and 5.2.14](https://daily.dev/posts/django-security-releases-issued-6-0-5-and-5-2-14-ujamegiya) · Django · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#webdev](https://daily.dev/tags/webdev), [#python](https://daily.dev/tags/python), [#django](https://daily.dev/tags/django) [View this post on daily.dev](https://daily.dev/posts/django-serve-a-security-txt-file-czhcqnylj) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Django: serve a security.txt file","url":"https://daily.dev/posts/django-serve-a-security-txt-file-czhcqnylj","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/django-serve-a-security-txt-file-czhcqnylj"},"datePublished":"2026-09-30T23:08:48.183Z","dateModified":"2026-09-30T23:09:09.624Z","description":"A step-by-step guide shows how to serve a standards-compliant security.txt file (per RFC 9116) from a Django application, including a view with proper...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9f6859bc392a090022db7c5eb5ead70a?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9f6859bc392a090022db7c5eb5ead70a?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Adam Johnson","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Adam Johnson","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/bf70f4401c284aa5b628d1966029342c","url":"https://daily.dev/sources/adamj"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/django-serve-a-security-txt-file-czhcqnylj","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,webdev,python,django","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Adam Johnson","item":"https://daily.dev/sources/adamj"},{"@type":"ListItem","position":3,"name":"Django: serve a security.txt file"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/django-serve-a-security-txt-file-czhcqnylj#faq","mainEntity":[{"@type":"Question","name":"How do I serve a security.txt file in Django with the correct content type?","acceptedAnswer":{"@type":"Answer","text":"Create a view using FileResponse that sets content_type to \"text/plain; charset=utf-8\", decorate it with @require_safe to limit it to GET and HEAD, and optionally @login_not_required and @cache_control for public caching. Wire it to the URL path \".well-known/security.txt\" in the root URLconf so it's reachable at /.well-known/security.txt as required by RFC 9116. daily.dev surfaces practical Django security patterns like this for developers hardening their sites."}},{"@type":"Question","name":"What fields are required in a security.txt file per RFC 9116?","acceptedAnswer":{"@type":"Answer","text":"Only two fields are required: Contact, a URI such as a mailto: address, https: URL, or tel: number telling researchers how to reach you; and Expires, an RFC 3339 timestamp after which the file should be considered stale, which must appear exactly once and is recommended to be set less than a year in the future. Developers publishing a security contact policy can track standards details like this on daily.dev."}},{"@type":"Question","name":"How can I make Django warn me when my security.txt Expires date is about to lapse?","acceptedAnswer":{"@type":"Answer","text":"Register a custom Django system check that parses the Expires field from the security.txt file, computes the remaining time until expiry, and returns a checks.Warning if less than 30 days remain or a second warning if more than 365 days remain (violating the RFC's under-a-year recommendation). System checks run automatically on commands like runserver, migrate, and test, so the warning surfaces without blocking work. daily.dev helps developers keeping maintenance tasks like expiry checks from slipping through the cracks."}}]} ```