Understanding the HTML http-equiv Meta Tag

Learn which http-equiv values are valid, which are deprecated, and when you should--or shouldn't--use them in modern web development.

What is http-equiv?

The http-equiv attribute on a <meta> element allows you to provide processing instructions for the browser as if the response that returned the document included certain HTTP headers. This metadata applies to the entire page and is defined at the document level.

When a <meta> element includes an http-equiv attribute, a content attribute specifies the corresponding value. For example, the following tag tells the browser to refresh the page after 5 minutes:

<meta http-equiv="refresh" content="300">

Most websites use http-equiv meta tags, but research shows many are using deprecated or unnecessary values. This guide covers what http-equiv actually does, which values are valid, and when you should use them.

Understanding proper meta tag implementation is essential for building standards-compliant websites that perform well and provide excellent user experiences. Proper implementation of meta tags connects directly to our web development services where we ensure every website meets modern standards.

http-equiv Usage on the Modern Web

67%

Websites using http-equiv meta tags

5

Standard conforming keywords

3

Deprecated or non-conforming keywords

Standard http-equiv Keywords

The HTML specification defines a limited set of valid http-equiv keywords. Understanding which are valid, deprecated, or non-conforming is essential for proper implementation.

Content-Security-Policy

The content-security-policy keyword allows page authors to define a content security policy for the current page, typically to specify allowed origins and script endpoints to guard against cross-site scripting attacks. This is equivalent to the Content-Security-Policy HTTP header.

<meta http-equiv="Content-Security-Policy" content="default-src https:">

This example sets a CSP that only allows resource loading over HTTPS. Because the unsafe-inline and unsafe-eval directives are not set, inline scripts will be blocked.

Implementing proper CSP is a critical component of website security that protects your site and users from common attack vectors.

Content-Type

The content-type keyword declares the document's media type and character encoding. The content attribute must be "text/html; charset=utf-8" if specified. This can only be used in text/html documents, not XML.

<meta http-equiv="content-type" content="text/html; charset=UTF-8">

Note: Using the simpler <meta charset="utf-8"> is the recommended modern approach.

Refresh

The refresh keyword specifies seconds until the page should reload, or seconds until redirect to another URL with ;url=.

<!-- Reload page every 30 seconds -->
<meta http-equiv="refresh" content="30">

<!-- Redirect after 5 seconds -->
<meta http-equiv="refresh" content="5;url=https://example.com/new-page">

Default-Style

Sets the name of the default CSS style sheet set when multiple stylesheets are available.

<meta http-equiv="default-style" content="main-styles">

Deprecated and Non-Conforming Keywords

Content-Language (Deprecated)

This keyword sets a default language for assistive technologies. However, the HTML specification marks this as deprecated--use the lang attribute on the <html> element instead.

Avoid:

<meta http-equiv="content-language" content="en">

Use instead:

<html lang="en">

Set-Cookie (Deprecated)

This keyword was intended to set cookies but browsers now ignore it entirely. Use the Set-Cookie HTTP response header or document.cookie JavaScript API instead.

X-UA-Compatible (Legacy)

Used by legacy versions of Internet Explorer so it more closely followed specified behavior. If specified, content must be "IE=edge". Modern browsers completely ignore this pragma since IE is no longer supported.

<!-- No longer needed--remove from all pages -->
<meta http-equiv="X-UA-Compatible" content="IE=edge">

Despite being ignored, over 6 million websites still use X-UA-Compatible.

Our code quality audits include checking for and removing these deprecated meta tags to keep your codebase clean and standards-compliant.

Common Misuse Patterns

Research from the HTTP Archive shows widespread use of deprecated and non-standard http-equiv values.

X-UA-Compatible

Used by 6+ million sites but completely ignored by modern browsers.

Content-language

Marked deprecated yet still found on millions of pages.

Security Headers

Never try to set HSTS, CORS, or other security headers via meta tags.

Origin-trial

Non-standard keyword used for browser feature experimentation.

Accessibility Considerations

The refresh directive requires careful attention to accessibility. Pages using http-equiv="refresh" risk having intervals too short for users to read content before being redirected.

People navigating with assistive technology such as screen readers may be unable to read through and understand the page's content before being automatically redirected. Abrupt, unannounced page updates may also be disorienting for people experiencing low vision conditions.

WCAG Guidelines

Web Content Accessibility Guidelines addresses this under:

  • 2.2.1 Timing Adjustable: Users should have control over time limits
  • 2.2.4 Auto-refreshing: Users should be able to extend or turn off time limits
  • 3.2.5 Change on Request: Unexpected context changes should be avoided

Best Practices for Refresh

When using refresh for page updates:

  1. Ensure the refresh interval is long enough for users to read content
  2. Provide a way for users to extend or disable auto-refresh
  3. Announce the refresh to screen reader users
<!-- Consider JavaScript alternatives for dynamic content updates -->
<script>
setInterval(() => {
 fetch('/api/data').then(r => r.json()).then(data => {
 document.getElementById('data-container').innerHTML = data.content;
 });
}, 5000);
</script>

Ensuring your website meets accessibility standards is part of our website maintenance services, where we verify all technical implementations comply with WCAG guidelines.

Implementation Best Practices

For Modern Websites

  1. Character Encoding: Use <meta charset="utf-8"> in the <head> (must appear within first 1024 bytes)
  2. Content Security Policy: Use meta tag only when HTTP headers aren't available
  3. IE Compatibility: Remove X-UA-Compatible tags entirely
  4. Language: Always use lang attribute on <html>

For Static Site Deployments

When deploying to platforms like GitHub Pages where server headers aren't configurable:

  • Use <meta http-equiv="Content-Security-Policy" ...> for CSP when needed
  • Use <meta charset="utf-8"> for character encoding
  • Avoid refresh meta tags; use JavaScript-based solutions if auto-refresh is required

Security Implications

What http-equiv Can Do:

  • Set Content Security Policy when HTTP headers aren't available
  • Specify character encoding to prevent encoding-based attacks
  • Control page refresh/redirect behavior

What http-equiv Cannot Do Reliably:

  • Set cookies (deprecated and ignored)
  • Control caching (use Cache-Control HTTP header)
  • Set security headers like HSTS or CORS
  • Override HTTP headers sent by the server
http-equiv Keyword Reference
KeywordStatusRecommended UseAlternative
content-security-policyValidWhen HTTP headers unavailableCSP HTTP header
content-typeValidUse charset attribute instead<meta charset="utf-8">
refreshValidWith accessibility considerationsJavaScript solutions
default-styleValidFor specifying default CSSCSS @import or <link>
content-languageDeprecatedUse lang attributelang="en" on <html>
set-cookieIgnoredUse HTTP headers or JavaScriptSet-Cookie header
x-ua-compatibleIgnoredRemove from all pagesN/A - not needed

Frequently Asked Questions

Summary

The http-equiv meta tag attribute provides a way to simulate HTTP response headers within HTML documents. However, only a small subset of HTTP headers are officially supported as valid http-equiv values.

When to Use http-equiv

  • Content-Security-Policy: When you cannot set CSP via HTTP headers
  • Character encoding: Use <meta charset="utf-8"> as the modern standard
  • Refresh/redirect: For simple redirects when server-side options aren't available

When to Avoid http-equiv

  • X-UA-Compatible: Modern browsers ignore this entirely--remove it
  • Content-language: Use the lang attribute instead
  • Set-Cookie: Use HTTP headers or JavaScript APIs
  • Any security headers: Prefer HTTP headers for security-sensitive directives

By understanding the limited scope of valid http-equiv values and avoiding deprecated or non-conforming keywords, you can ensure your web pages are standards-compliant and provide the best experience for all users.

Proper meta tag implementation is just one aspect of building high-quality websites. Our team specializes in full-stack web development ensuring every technical detail meets modern standards and best practices.

Need Help with Your Web Development?

Our team of experts can help you implement best practices for meta tags, security headers, and modern web development standards.

Sources

  1. MDN Web Docs - Meta http-equiv attribute - Official documentation for all standard http-equiv values
  2. HTML Spec - Pragma Directives - W3C HTML specification defining valid http-equiv keywords
  3. You probably don't need http-equiv meta tags - HTTP Archive analysis showing 67% of websites use http-equiv tags