diff --git a/web/fup/fuphttp/fuphttp.go b/web/fup/fuphttp/fuphttp.go
index 9405e6e995..f921114c7a 100644
--- a/web/fup/fuphttp/fuphttp.go
+++ b/web/fup/fuphttp/fuphttp.go
@@ -83,11 +83,19 @@ func (a *Application) notFound(rw http.ResponseWriter, r *http.Request) {
 }
 
 func (a *Application) internalError(rw http.ResponseWriter, r *http.Request) {
-	rw.Header().Set("Content-type", "text/plain")
+	rw.Header().Set("Content-type", "text/plain; charset=utf-8")
+	rw.Header().Set("X-Content-Type-Options", "nosniff")
 	rw.WriteHeader(http.StatusInternalServerError)
 	fmt.Fprintf(rw, "hammed server :(\n")
 }
 
+func (a *Application) badRequest(rw http.ResponseWriter, r *http.Request, err error) {
+	rw.Header().Set("Content-type", "text/plain; charset=utf-8")
+	rw.Header().Set("X-Content-Type-Options", "nosniff")
+	rw.WriteHeader(http.StatusBadRequest)
+	fmt.Fprintf(rw, "bad request: %v\n", err.Error())
+}
+
 func parseTemplate(t *template.Template, fsys fs.FS, name string) (*template.Template, error) {
 	bs, err := fs.ReadFile(fsys, name)
 	if err != nil {