Response hygiene

What it is

An explicit content-type with a charset, x-content-type-options: nosniff, and HSTS. Small things.

Why an agent cares

When content-type is missing or wrong, automated parsers fall back to sniffing, and sniffing is where encoding bugs and mangled text come from.

These headers cost nothing and they are a reasonable proxy for whether anyone is minding the infrastructure.

How to fix it

1. Send content-type: text/html; charset=utf-8 explicitly.
2. Add x-content-type-options: nosniff.
3. Add strict-transport-security once HTTPS is everywhere.

How we test it

We read the response headers from the homepage fetch and check for all three.

Related