security.txt in PHP konfigurieren

<?php
// .well-known/security.txt.php — RFC 9116
header('Content-Type: text/plain; charset=utf-8');

$expires = date('Y-m-d\TH:i:sP', strtotime('+1 year'));

echo "Contact: mailto:security@ihre-domain.de\n";
echo "Expires: {$expires}\n";
echo "Preferred-Languages: de, en\n";
echo "Canonical: https://ihre-domain.de/.well-known/security.txt\n";
echo "Policy: https://ihre-domain.de/security-policy\n";
echo "Encryption: https://ihre-domain.de/.well-known/pgp-key.txt\n";

# .htaccess — Rewrite fuer security.txt
# Leitet /.well-known/security.txt auf PHP-Script um

RewriteEngine On
RewriteRule ^.well-known/security\.txt$ .well-known/security.txt.php [L]

# Alternative: Statische Datei direkt ablegen unter
# .well-known/security.txt (kein PHP noetig)
# Nachteil: Expires muss manuell aktualisiert werden

<?php
// src/Controller/SecurityTxtController.php
// Fuer Laravel, Symfony oder Slim

namespace App\Controller;

class SecurityTxtController
{
    public function __invoke(): Response
    {
        $expires = date('Y-m-d\TH:i:sP',
            strtotime('+1 year'));

        $content = implode("\n", [
            "Contact: mailto:security@ihre-domain.de",
            "Expires: {$expires}",
            "Preferred-Languages: de, en",
            "Canonical: https://ihre-domain.de/.well-known/security.txt",
            "Policy: https://ihre-domain.de/security-policy",
        ]);

        return new Response($content, 200, [
            'Content-Type' => 'text/plain; charset=utf-8',
        ]);
    }
}