Free Content-Type Header Checker
Check Content-Type headers for MIME accuracy, charset, and nosniff coverage. Stops MIME confusion attacks and browser rendering bugs before they ship.
- Content-Type checks
- Charset guidance
- Correct MIME usage

What you get for free
18 core security checks via this tool, passive scans, step-by-step remediation, security score on every result.
What Essential adds at $39/mo
+17 advanced checks, continuous monitoring, daily security score history, email alerts, GitHub SAST, board-ready PDFs, SOC 2 / ISO 27001 / PCI reports.
How to fix common issues
- Set accurate MIME types (e.g., text/html, application/json, text/css)
- Include charset for text types (e.g., utf-8)
What is Content-Type?
The Content-Type header tells browsers how to interpret a response. Correct MIME types and charsets prevent sniffing and rendering issues.
Implementation examples
Once you've identified the gap, applying the fix is straightforward. Here are the three configurations developers reach for most often.
Nginx
# Send correct MIME types from /etc/nginx/mime.types
include mime.types;
default_type application/octet-stream;
# Force UTF-8 on text responses
charset utf-8;
charset_types text/html text/css text/plain application/javascript application/json;
# Block MIME-sniffing
add_header X-Content-Type-Options "nosniff" always;Apache
# Ensure mod_mime is enabled and types are correct
AddType application/json .json
AddType text/css .css
AddType application/javascript .js
# Default charset for text responses
AddDefaultCharset utf-8
# Block MIME-sniffing
Header always set X-Content-Type-Options "nosniff"Node.js (Express + Helmet)
import express from "express"
import helmet from "helmet"
const app = express()
// Sets X-Content-Type-Options: nosniff
app.use(helmet.noSniff())
app.get("/api/data", (req, res) => {
// Always set an explicit Content-Type with charset for text payloads
res.type("application/json; charset=utf-8").send({ ok: true })
})Tool-specific questions
Is charset required?
application/json vs text/json?
Built for the engineers who already have enough to fix.
Real-time results
Comprehensive checks
Step-by-step fixes
More free checks, for the rest of your surface.
Complete Security Scan
Pre-Pentest Security Scan
Security Compliance Checker
WAF Checker
Security Headers Test
TLS/SSL Security Checker
Frequently asked.
What is Barrion and how does it enhance website security?
How safe is Barrion to use for security testing?
What types of security issues does Barrion identify?
What specific security checks does Barrion perform?
What is Barrion's smart crawling?
How often does Barrion perform security scans?
Is Barrion suitable for security testing of all business sizes?
How does Barrion handle data security and privacy during security testing?
What if I'm not satisfied with Barrion's security testing service?
How does Barrion help with SOC 2, ISO 27001, NIS2, and other compliance frameworks?
Anything else? Email contact@barrion.io.
Run a full report on your site.
Free first scan covers every check, no signup needed. Sign up to save the report and turn on continuous monitoring.