HTML MIME Type: text/html

About HTML files

Send text/html; charset=utf-8 and also keep <meta charset="utf-8"> as the first thing in <head>, so pages saved to disk still decode correctly. Anything served as text/html can run scripts, so never send user-uploaded files with this type from your main domain.

XHTML parsed as strict XML needs application/xhtml+xml; with text/html, the browser uses the normal, forgiving HTML parser.

Other types seen for these files: application/xhtml+xml . Accept them when reading uploads, but send text/html yourself.

File signature

HTML has no fixed signature: it is text without a magic number, so validate uploads by parsing the content rather than by checking bytes.

Serve .html with the right Content-Type

Response header

Content-Type: text/html; charset=utf-8

nginx (a line in the types { } block of mime.types)

text/html html htm;

Apache (.htaccess or server config)

AddType text/html .html .htm
AddCharset UTF-8 .html .htm

Caddy

@html path *.html *.htm
header @html Content-Type "text/html; charset=utf-8"

Check what a server sends

curl -sI https://example.com/file.html | grep -i '^content-type'
# Content-Type: text/html; charset=utf-8

Set the type in code

Node.js (Express)

res.set('Content-Type', 'text/html; charset=utf-8');

Python

import mimetypes

mimetypes.add_type('text/html', '.html')  # if your system doesn't know it
mimetypes.guess_type('file.html')[0]  # 'text/html'

mime.AddExtensionType(".html", "text/html; charset=utf-8")
w.Header().Set("Content-Type", "text/html; charset=utf-8")

Accept .html uploads

HTML

<input type="file" accept=".html,.htm,text/html">

The accept attribute only filters the file picker; users can still choose another file. Listing the extension as well as the type matters, because operating systems don’t always report the type you expect.

Related types

.css (text/css): CSS stylesheet
.js (text/javascript): JavaScript
.svg (image/svg+xml): SVG image

More web

.mjs , .wasm , .webmanifest , .rss , .vtt . Look up any extension or type with the MIME type lookup.

Sources

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions

What is the MIME type for .html files?

text/html. You may also see application/xhtml+xml, which is older or unofficial; send text/html. It is a text format, so add the character set: "Content-Type: text/html; charset=utf-8".

Why does my server send the wrong Content-Type for .html?

Web servers pick the type from the file extension using a table (mime.types in nginx and Apache). If .html is missing from that table, they send a default such as application/octet-stream or text/plain. Add the mapping as shown on this page, then check the response with "curl -sI".

How can I check that a file really is HTML?

HTML has no fixed file signature, so the extension and content are all you have. Check that the content is what you expect, for example by parsing it, before trusting an upload.