Headers Security
low Severity
Free Check
Content-Type Header & Charset Declaration
Ensures all HTML/API responses specify an explicit Content-Type with charset=utf-8 to prevent UTF-7 encoding bypasses.
Why It Matters
Omitting charset declarations can allow legacy encoding attacks where UTF-7 payloads bypass input filters.
How We Check This
We check that responses return Content-Type: text/html; charset=utf-8 or application/json; charset=utf-8.
How to Fix & Implement
Copy-paste configuration blocks tailored for your web server or edge proxy.
nginx snippet
charset utf-8;
Frequently Asked Questions
Why is UTF-7 an issue?
UTF-7 represents angle brackets and quotes without standard characters, historically bypassing basic XSS filters.