How do I fix a missing charset declaration?

A missing charset declaration leaves the browser to infer how the raw bytes of your document map to characters, and an incorrect guess is what produces garbled text: a curly apostrophe or an accented letter arriving as a sequence like ’. The in-document fix is a meta charset element in the head that names the encoding, and for HTML5 there is exactly one valid value, UTF-8.

Why this matters

The rule is stricter than it looks. MDN states that if the charset attribute is present, its value must be an ASCII case-insensitive match for the string "utf-8", because UTF-8 is the only valid encoding for HTML5 documents. That means charset="utf8" and CHARSET="UTF-8" are both acceptable, but charset="iso-8859-1" is not a conforming choice for an HTML5 page, even though browsers still understand the old label.

Placement is the part people get wrong. The HTML specification requires the element containing the character encoding declaration to be serialized completely within the first 1024 bytes of the document, and MDN repeats the same constraint: the meta element that declares the encoding must be located entirely within the first 1024 bytes. If you bury the declaration beneath a long license comment, a large inline script, or a wall of head links, it can fall past that boundary and be ignored, which is indistinguishable from a missing charset declaration.

A wrong encoding is a rendering and a security problem. Text becomes unreadable for users, search snippets and social previews pick up replacement characters, and content that is later echoed into an HTML context can be misinterpreted. Servers that sniff content can also be tricked into treating markup as a different type when the declared encoding disagrees with the bytes.

How to fix it

Make the declaration the first thing inside the head, before the title and any script or style, so it is unambiguously inside the first 1024 bytes. Keep it lowercase and match the encoding your files are actually saved in; declaring UTF-8 while the file is still encoded as Windows-1252 or Shift_JIS will reliably break characters. Serve the same information on the response by including the charset parameter on the Content-Type header, which is set by your server, reverse proxy, or CDN rather than by the document.

<!doctype html>
<html lang="en">
  <head>
    <meta charset="utf-8">
    <title>Example</title>
  </head>
  <body>
    <p>Café — résumé</p>
  </body>
</html>

Content-Type: text/html; charset=utf-8

How to verify the fix

Read only the first kilobyte of the response, which is the region the encoding declaration must occupy, and confirm the declaration is there. Checking the full body can hide the problem, because a valid meta tag that appears late was never honored in the first place.

curl -s https://example.com/ | head -c 1024 | grep -i charset

Automated check

The Auditor raises a Missing charset declaration finding at Low severity when the document has no encoding declaration in its head. Because the check is about presence, it is worth confirming by hand that the tag sits within the opening 1024 bytes and that it says utf-8, since a late or non-utf-8 declaration passes the eye but fails the browser.

Scan your app free →

Related issues