MIME Types & Security Headers Hub
Secure your web applications and configure server responses with confidence. Use this interactive hub to find definitions, best practices, and real-world examples of headers and content types.
100% Private & Secure
This tool runs completely inside your browser using client-side WebAssembly and JS. Zero data is ever sent to our servers.
Content-Security-Policy (CSP)
SecurityPrevents XSS by defining which resources the browser is allowed to load.
default-src 'self'; script-src 'self' https://trusted.comStrict-Transport-Security (HSTS)
SecurityTells the browser to only communicate with the server over HTTPS.
max-age=63072000; includeSubDomains; preloadX-Content-Type-Options
SecurityPrevents MIME-sniffing by the browser.
nosniffX-Frame-Options
SecurityControls whether your site can be embedded in an <iframe> (Clickjacking protection).
DENY / SAMEORIGINReferrer-Policy
SecurityControls how much referrer information is sent with requests.
no-referrer-when-downgradeapplication/json
MIME TypeStandard format for API responses and configuration data.
text/html
MIME TypeStandard format for web pages.
image/svg+xml
MIME TypeScalable Vector Graphics format.
application/pdf
MIME TypePortable Document Format.
multipart/form-data
MIME TypeUsed for submitting forms with binary file uploads.
application/javascript
MIME TypeStandard format for executable scripts.
Cache-Control
CachingDirective for caching mechanisms in both browsers and proxies.
public, max-age=31536000, immutableETag
CachingA unique identifier for a specific version of a resource.
W/"xy-12345"How to use this tool
- Filter by category (Security, MIME Type, Caching) using the top buttons
- Search for a specific header or type (e.g., 'CSP' or 'JSON')
- Copy the pro-grade examples directly into your server configuration files
Example Usage
CSP
Content-Security-Policy: default-src 'self'...
nosniff
X-Content-Type-Options: nosniff
When to use this tool
- Configuring Nginx or Apache security headers
- Setting correct Content-Type for API responses
- Auditing website security posture
Frequently Asked Questions
Why is the 'nosniff' header important?
The 'X-Content-Type-Options: nosniff' header prevents the browser from trying to guess the content type of a resource, which could lead to security vulnerabilities if an attacker manages to upload a file with a misleading extension.
What does CSP protect against?
Content Security Policy (CSP) is primarily designed to mitigate Cross-Site Scripting (XSS) attacks by strictly controlling which resources are allowed to be loaded and executed by the browser.
More Developer Tools
Security Best Practice
"Default to deny. Start with a strict Content-Security-Policy and only whitelist the domains and sources you absolutely trust. A secure header configuration is the first line of defense in modern web infrastructure."