MIME Types — Configuring Media Types for Web Servers Correctly

A MIME type — also called a media type — tells the browser what to do with the bytes of a response. Unlike on a file system, the web does not rely on the file extension: the Content-Type header sent by the server decides the behaviour. A wrong type breaks rendering: web fonts fail to load, JavaScript modules are blocked, stylesheets are ignored. Add charset=utf-8 to define the character encoding for text types, and set X-Content-Type-Options: nosniff to stop browsers from guessing the type — an important defence against MIME-sniffing attacks. This reference lists the common media types by category and shows how to map them correctly in Apache and nginx.

Text Types

text/html — HTML documents. The primary content type for web pages. Default charset is US-ASCII; always specify UTF-8.

Content-Type: text/html; charset=UTF-8

text/css — Cascading Style Sheets. Required for to be applied by browsers.

<link rel="stylesheet" href="style.css"> — server must send text/css

text/javascript — JavaScript code. The official IANA type (replaces application/javascript and application/x-javascript).

Content-Type: text/javascript — used for <script src> responses

text/plain — Plain unformatted text. Browsers display it as-is, without rendering HTML. Default extension: .txt.

Content-Type: text/plain; charset=UTF-8 — robots.txt, README files

text/csv — Comma-Separated Values for tabular data. RFC 4180. Often triggers download dialogs in browsers.

Content-Disposition: attachment; filename=export.csv
Content-Type: text/csv

text/xml — XML as a text type, readable by humans. Prefer application/xml for API responses.

Used for RSS feeds and simple XML configurations.

text/markdown — Markdown-formatted text. RFC 7763. Not rendered by browsers natively; use application/octet-stream to force download.

Content-Type: text/markdown; variant=GFM

text/calendar — iCalendar format for calendar events (.ics files). RFC 5545. Triggers calendar app associations.

Content-Type: text/calendar; charset=UTF-8 — event.ics download

text/vcard — vCard format for contact information (.vcf files). Triggers contact import dialogs on mobile.

Content-Type: text/vcard — contact.vcf download

text/event-stream — Server-Sent Events (SSE) stream. Required for EventSource API. Keeps the connection open for push events.

Content-Type: text/event-stream
Cache-Control: no-cache

Application — Web, Data & APIs

application/json — JSON-encoded data. The standard type for REST API request and response bodies. RFC 8259.

Content-Type: application/json
Accept: application/json

application/ld+json — JSON-LD (Linked Data). Used for Schema.org structured data embedded in HTML pages for SEO.

<script type="application/ld+json">{"@context":"https://schema.org",...}</script>

application/xml — XML-encoded data for APIs and data exchange. Use text/xml only if the content is human-readable.

Content-Type: application/xml — SOAP, Atom feeds, config APIs

application/graphql — GraphQL query string. Informal but widely used. Alternatively send as application/json with a query field.

Content-Type: application/graphql — POST /graphql with raw query body

application/x-www-form-urlencoded — URL-encoded form data (key=value&key2=value2). Default encoding for HTML forms without file uploads.

<form method="POST"> without enctype — sends application/x-www-form-urlencoded

application/octet-stream — Arbitrary binary data / unknown type. Browsers treat it as a download. The safe fallback for unknown files.

Content-Type: application/octet-stream
Content-Disposition: attachment; filename=data.bin

application/pdf — Adobe Portable Document Format (.pdf). Browsers usually display PDFs inline using their built-in viewer.

Content-Type: application/pdf — add Content-Disposition: attachment to force download

application/yaml — YAML Ain't Markup Language. RFC 9512 (2024). Used for OpenAPI/Swagger specs and config files.

Content-Type: application/yaml — OpenAPI spec endpoint

application/wasm — WebAssembly binary module. Required for .wasm files to be compiled efficiently by browsers (RFC).

Content-Type: application/wasm — required for streaming compilation with WebAssembly.instantiateStreaming()

application/manifest+json — Web App Manifest (.webmanifest). Defines PWA metadata: name, icons, theme color, display mode.

<link rel="manifest" href="/app.webmanifest"> — server must serve this type

application/rss+xml — RSS feed format for syndication. Extension: .rss. Browsers and feed readers detect it automatically.

<link rel="alternate" type="application/rss+xml" href="/feed.rss">

application/atom+xml — Atom syndication feed. RFC 4287. More standardized than RSS, used by many modern feed sources.

<link rel="alternate" type="application/atom+xml" href="/feed.atom">

Application — Archives & Compressed Files

application/zip — ZIP archive format. The most common archive type on the web. Extension: .zip.

Content-Type: application/zip — download.zip

application/gzip — gzip-compressed data (.gz). Different from Content-Encoding: gzip — this is the file itself.

Content-Type: application/gzip — backup.tar.gz

application/x-bzip2 — bzip2-compressed archive (.bz2). Better compression than gzip, common on Linux distributions.

Content-Type: application/x-bzip2 — archive.tar.bz2

application/x-xz — XZ compressed data (.xz). High compression ratio, used for Linux kernel and distro packages.

Content-Type: application/x-xz — package.tar.xz

application/x-7z-compressed — 7-Zip archive format (.7z). Very high compression, common on Windows.

Content-Type: application/x-7z-compressed — archive.7z

application/x-rar-compressed — RAR archive format (.rar). Proprietary format, common for large software distributions.

Content-Type: application/x-rar-compressed — archive.rar

application/x-tar — TAR archive (uncompressed, .tar). Usually combined with gzip (.tar.gz) or bzip2 (.tar.bz2).

Content-Type: application/x-tar — files.tar

application/java-archive — Java Archive (.jar). A ZIP file containing Java class files and resources.

Content-Type: application/java-archive — app.jar

Application — Office & Document Formats

application/vnd.openxmlformats-officedocument.wordprocessingml.document — Microsoft Word document (.docx). OOXML format used by Word 2007 and later.

Content-Type: application/vnd.openxmlformats-officedocument.wordprocessingml.document

application/vnd.openxmlformats-officedocument.spreadsheetml.sheet — Microsoft Excel spreadsheet (.xlsx). OOXML format used by Excel 2007 and later.

Content-Type: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet

application/vnd.openxmlformats-officedocument.presentationml.presentation — Microsoft PowerPoint presentation (.pptx). OOXML format used by PowerPoint 2007 and later.

Content-Type: application/vnd.openxmlformats-officedocument.presentationml.presentation

application/vnd.ms-excel — Legacy Microsoft Excel format (.xls). Binary format from Excel 97–2003.

Content-Type: application/vnd.ms-excel — legacy.xls

application/vnd.oasis.opendocument.text — OpenDocument Text format (.odt). Used by LibreOffice Writer.

Content-Type: application/vnd.oasis.opendocument.text — document.odt

application/vnd.oasis.opendocument.spreadsheet — OpenDocument Spreadsheet format (.ods). Used by LibreOffice Calc.

Content-Type: application/vnd.oasis.opendocument.spreadsheet — sheet.ods

application/epub+zip — EPUB e-book format (.epub). A ZIP file containing HTML, CSS, images, and metadata.

Content-Type: application/epub+zip — book.epub

application/rtf — Rich Text Format (.rtf). Cross-platform document format supported by most word processors.

Content-Type: application/rtf — document.rtf

Image Types — Classic Raster Formats

image/jpeg — JPEG/JPG — lossy compression for photos (.jpg, .jpeg). Widely supported, no transparency. Best for photos.

<img src="photo.jpg"> — server sends image/jpeg; quality vs. file size tradeoff

image/png — PNG — lossless compression with full alpha transparency (.png). Best for graphics, logos, screenshots.

<img src="logo.png"> — server sends image/png; larger than JPEG for photos

image/gif — GIF — 256 colors, lossless, supports animation (.gif). Largely replaced by WebP for animation.

<img src="animation.gif"> — still widely used for short looping animations

image/bmp — BMP — Windows Bitmap, uncompressed raster format (.bmp). Very large files, no web use.

Rarely used on the web. Used internally by Windows for icons and wallpapers.

image/tiff — TIFF — high-quality lossless format for print and archiving (.tif, .tiff). Not supported natively in browsers.

Used in print workflows, medical imaging, and professional photography.

image/x-icon — ICO — Windows icon format (.ico). Used for browser favicons. Supports multiple sizes in one file.

<link rel="icon" type="image/x-icon" href="/favicon.ico">

image/svg+xml — SVG — Scalable Vector Graphics (.svg). XML-based, resolution-independent, fully scriptable. Ideal for icons and logos.

<img src="icon.svg"> or inline <svg>. CSS animations and JS interaction possible.

Image Types — Modern Formats

image/webp — WebP — Google format with lossy and lossless modes, transparency, and animation support (.webp). 25–34% smaller than JPEG/PNG. Supported by all modern browsers.

<picture><source type="image/webp" srcset="img.webp"><img src="img.jpg"></picture>

image/avif — AVIF — AV1 Image File Format (.avif). Excellent compression (better than WebP), HDR, wide color gamut, alpha. Supported in Chrome 85+, Firefox 93+, Safari 16+.

<picture><source type="image/avif" srcset="img.avif"><source type="image/webp" srcset="img.webp"><img src="img.jpg"></picture>

image/jxl — JPEG XL — next-gen format with lossless JPEG recompression, HDR, wide gamut, animation (.jxl). Superior quality/size. Safari 17.4+ (macOS/iOS). Chrome/Firefox support behind flags or dropped.

Accept: image/jxl, image/avif, image/webp, image/jpeg — server-side content negotiation

image/heic — HEIC — High Efficiency Image Container (.heic). Apple's default camera format (iPhone iOS 11+). Based on HEVC/H.265. Limited browser support; usually converted server-side.

iPhone uploads: convert HEIC → JPEG/WebP/AVIF before serving on the web.

image/heif — HEIF — High Efficiency Image Format (.heif). The container standard that HEIC is based on. Same limitations as HEIC for web use.

Content-Type: image/heif — HEIC uses the same MIME type family; use heic for Apple files.

image/apng — APNG — Animated PNG (.apng, .png). Supports full-color animation with alpha, unlike GIF. Supported in all modern browsers.

<img src="animation.apng"> — full 24-bit color with transparency, unlike GIF's 256 colors

image/jp2 — JPEG 2000 (.jp2) — wavelet-based compression, lossless mode, transparency. Only natively supported in Safari (macOS/iOS). Not recommended for general web use.

Safari on macOS accepts image/jp2. Other browsers need JS decode libraries.

Audio Types

audio/mpeg — MP3 audio (.mp3). The most universally supported audio format. Uses MPEG-1/2 Audio Layer III compression.

<audio controls><source src="track.mp3" type="audio/mpeg"></audio>

audio/ogg — Ogg Vorbis or Opus audio in an Ogg container (.ogg, .oga). Open, patent-free. Good Firefox/Chrome support.

<source src="audio.ogg" type="audio/ogg; codecs=vorbis">

audio/opus — Opus audio codec (.opus). Open format optimized for speech and music, low latency. Excellent for WebRTC and streaming.

<source src="speech.opus" type="audio/opus"> — best codec for real-time audio (WebRTC)

audio/wav — WAV — uncompressed PCM audio (.wav). Very large files, no compression. Used for lossless archiving and as audio source in Web Audio API.

<source src="sample.wav" type="audio/wav"> — high quality but large file size

audio/webm — WebM container with Vorbis or Opus audio (.weba, .webm). Open format backed by Google.

<source src="audio.webm" type="audio/webm; codecs=opus">

audio/aac — AAC — Advanced Audio Coding (.aac, .m4a). Successor to MP3 with better quality at same bitrate. Native on iOS/Safari.

<source src="track.aac" type="audio/aac"> — commonly used on Apple devices

audio/flac — FLAC — Free Lossless Audio Codec (.flac). Perfect audio reproduction, ~50% of WAV size. Supported in modern browsers.

<source src="hifi.flac" type="audio/flac"> — lossless streaming for audiophiles

audio/mp4 — MP4 container with audio-only content (.m4a, .m4b). Typically contains AAC or ALAC audio.

Content-Type: audio/mp4 — Apple audiobooks (.m4b), iTunes purchases (.m4a)

Video Types

video/mp4 — MPEG-4 Part 14 (.mp4, .m4v). The most widely supported video format on the web. Usually contains H.264/AVC video and AAC audio.

<video controls><source src="video.mp4" type="video/mp4"></video>

video/webm — WebM — Google's open video format (.webm). Contains VP8/VP9/AV1 video with Vorbis/Opus audio. Excellent compression.

<source src="video.webm" type="video/webm; codecs=vp9,opus"> — smaller than H.264 MP4

video/ogg — Ogg container with Theora video (.ogv). Open, patent-free. Mostly replaced by WebM in modern browsers.

<source src="video.ogv" type="video/ogg; codecs=theora,vorbis">

video/mpeg — MPEG-1 or MPEG-2 video (.mpeg, .mpg). Legacy format from the 1990s. Limited browser support.

Content-Type: video/mpeg — DVD and broadcast video; use MP4 for web delivery

video/quicktime — Apple QuickTime video (.mov). Typically contains H.264 or ProRes. Good support in Safari; use MP4 for cross-browser.

Content-Type: video/quicktime — iMovie/Final Cut exports; transcode to MP4 for web

video/x-msvideo — AVI — Audio Video Interleave (.avi). Legacy Microsoft format. No native browser support; must be converted.

Content-Type: video/x-msvideo — convert to MP4 or WebM before web delivery

video/x-matroska — Matroska / MKV container (.mkv). Popular for high-quality video with multiple audio/subtitle tracks. Limited browser support.

Content-Type: video/x-matroska — use for downloads; transcode to MP4/WebM for streaming

video/mp4; codecs=av01 — AV1 video has no standalone file MIME type; it is served inside an MP4 (video/mp4) or WebM (video/webm) container with codecs=av01…. Open, royalty-free, ~50% better compression than H.264. Chrome 70+, Firefox 67+, Safari 17+.

<source src="video.webm" type="video/webm; codecs=av01.0.05M.08"> — best compression ratio

Font Types

font/woff2 — Web Open Font Format 2 (.woff2). The recommended modern web font format. Brotli compression, ~30% smaller than WOFF. Supported by all modern browsers.

@font-face { src: url('font.woff2') format('woff2'); } — use this as primary format

font/woff — Web Open Font Format 1 (.woff). Fallback for older browsers (IE9+). zlib compression. Larger than WOFF2.

@font-face { src: url('font.woff2') format('woff2'), url('font.woff') format('woff'); }

font/ttf — TrueType Font (.ttf). Uncompressed outline font. Used as fallback and natively on Android/iOS.

@font-face { src: url('font.ttf') format('truetype'); } — fallback for very old browsers

font/otf — OpenType Font (.otf). Supports advanced typography (ligatures, small caps, alternates). Uncompressed like TTF.

@font-face { src: url('font.otf') format('opentype'); } — preferred for advanced typography

font/collection — Font Collection (.ttc, .otc). A single file containing multiple font faces (e.g., CJK collections).

Content-Type: font/collection — NotoSansCJK.ttc containing Regular, Bold, Italic

Multipart & Form Data

multipart/form-data — Used for HTML form uploads containing files. Required for . Includes a boundary delimiter.

<form enctype="multipart/form-data"> — Content-Type: multipart/form-data; boundary=----XYZ

multipart/mixed — Multiple body parts of different types. Used in email (attachments) and some batch API responses.

MIME email with text/plain body + application/pdf attachment — multipart/mixed

multipart/alternative — Multiple alternative representations of the same content. Used in email for text/plain + text/html versions.

Email multipart/alternative: text/plain for old clients, text/html for modern clients

multipart/byteranges — Server response containing multiple byte ranges (for HTTP 206 multi-range responses).

GET /file.pdf with Range: bytes=0-100,200-300 → 206 multipart/byteranges response

Tips & HTTP Header Usage

Content-Type: type/subtype; charset=UTF-8 — Sent by server to tell the client what the response body is. The charset parameter is critical for text types.

Content-Type: application/json — no charset needed (JSON is always UTF-8 per RFC 8259)

Accept: image/avif,image/webp,image/jpeg,*/* — Sent by client to declare which types it accepts. Use for content negotiation to serve the best format.

Chrome sends: Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8

Content-Disposition: attachment; filename="file.pdf" — Forces a download dialog regardless of Content-Type. Use filename* for UTF-8 filenames (RFC 5987).

Content-Disposition: attachment; filename*=UTF-8''Daten%C3%BCbersicht.csv

X-Content-Type-Options: nosniff — Prevents browsers from MIME-sniffing (guessing the type). Always set this header to avoid XSS via type confusion.

Without nosniff, a browser may execute an HTML file served as text/plain as HTML.

type/* wildcard in Accept header — Use wildcards to accept any subtype. image/* accepts all images, / accepts everything (with lowest priority).

Accept: application/json, text/*, */*;q=0.1 — prefer JSON, then any text, then anything

q-factor (quality value) in Accept — Numeric priority from 0 to 1 (default 1.0). Tells the server which format is preferred when multiple types are listed.

Accept: text/html, application/json;q=0.9, */*;q=0.8 — prefer HTML, then JSON

Apache: AddType / TypesConfig — Configure MIME types in Apache via .htaccess or httpd.conf. Use AddType for one-off additions.

AddType image/avif .avif
AddType image/webp .webp
AddType font/woff2 .woff2

Nginx: types { } block in mime.types — Nginx reads /etc/nginx/mime.types. Add missing types in the server or http block using types { } override.

types { image/avif avif; image/webp webp; font/woff2 woff2; application/wasm wasm; }

PHP: header('Content-Type: ...') — Set the response content type in PHP before any output. Overrides the server's default.

header('Content-Type: application/json; charset=UTF-8');
echo json_encode($data);

Conclusion

The right MIME type is not a detail — it decides whether browsers render your content correctly or block it. Always set charset=utf-8 for text types, serve modern formats like image/avif and font/woff2 with their proper types, and enable X-Content-Type-Options: nosniff to stop MIME sniffing. Maintain missing mappings centrally in your web server's mime.types rather than scattering them across individual AddType lines.