Serve a security.txt File

<?php
/**
 * Serves a security.txt file per RFC 9116.
 * Update the Contact address before activating this snippet.
 * Reference: https://securitytxt.org/
 */
if ( ! function_exists( 'scseed_serve_security_txt' ) ) {
    function scseed_serve_security_txt() {
        if ( ! isset( $_SERVER['REQUEST_URI'] ) ) {
            return;
        }
        $path = parse_url(
            sanitize_text_field( wp_unslash( $_SERVER['REQUEST_URI'] ) ),
            PHP_URL_PATH
        );
        if ( '/.well-known/security.txt' !== $path ) {
            return;
        }
        // Build an ISO 8601 expiry date without relying on backslash escapes.
        $dt      = new DateTime( '+1 year', new DateTimeZone( 'UTC' ) );
        $expires = $dt->format( 'Y-m-d' ) . 'T' . $dt->format( 'H:i:s' ) . 'Z';
        $site    = esc_url( home_url() );

        header( 'Content-Type: text/plain; charset=utf-8' );
        echo 'Contact: mailto:[email protected]' . PHP_EOL; // Change to your address.
        echo 'Expires: ' . $expires . PHP_EOL;
        echo 'Preferred-Languages: en' . PHP_EOL;
        echo 'Canonical: ' . $site . '/.well-known/security.txt' . PHP_EOL;
        exit;
    }
    add_action( 'init', 'scseed_serve_security_txt', 1 );
}