> ## Documentation Index
> Fetch the complete documentation index at: https://docs.safesquid.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Content Signatures

<Note>
  CLI man page: `safesquid-contentSignatures(5)`
</Note>

The **Content Signatures** section (`safesquid-contentSignatures(5)`) maintains the content-signature database and libmagic MIME detection used across SafeSquid. It helps identify actual file types, bypassing deceptive file extensions — but live connection tagging for policy uses [Response Types](/admin_guide/policies_and_profiles/response_types) in the current build.

<Note>
  Custom rows are merged into `content4.xml` under `/var/lib/safesquid/content_signatures/`. Tag names still appear in DLP and UI pickers even when the request-time hooks are inactive.
</Note>

## Core mechanics

### What runs at runtime today

1. On config load and on scheduled update, SafeSquid may download vendor `content4.xml` and reload the merged database.
2. Custom rows from the Web UI are saved to the dev copy of `content4.xml` when the section is displayable.
3. The internal MIME engine uses the libmagic database from this directory for body type detection (also used by DLP, logging, and Response Types).
4. The request-time hooks are **not implemented** — list rows do not add or remove connection tags at request time in the current build.

<Warning>
  For live response labelling by MIME or extension, use [Response Types](/admin_guide/policies_and_profiles/response_types). Content Signatures rows still matter for database maintenance, autocomplete in other sections (for example DLP), and libmagic setup.
</Warning>

### Global Enabled

When off, the section reports itself disabled — signature database download/reload and MIME library setup are affected. List rows are still persisted even when the request-time hooks are inactive.

### Subsections

* **Content Signatures List** — MIME regex rows plus tags to add. Stored in config; not applied on connections at request time today.
* **Content Categories List** — Category names for autocomplete and grouping in signature rows.
* **Content File Extensions** — Extension regex rows plus extension tags. The matching request-time hook is not implemented.

### Legacy UI options

Selectors such as **Transfer Encoding Chunk**, **multi-part byte-range**, and **Trace Entry** under Content Signatures are not bound to any template field in this tree — they have no effect here (the same labels on Response Types do affect matching).

## Examples

<Tip>
  ### Maintain a custom MIME tag for DLP autocomplete

  * Content Signatures List: Mime type `^application/x-custom`, Added Content Signatures `CustomApp`

  **Result:** tag name appears in DLP and UI pickers. Connection tags are not added automatically — pair with a Response Types row if policy must match live traffic.
</Tip>

<Tip>
  ### Policy on detected downloads (use Response Types)

  * Response Types: Content type `^application/zip`, Added Response Types `archive-download`

  **Result:** live traffic is tagged using response headers and libmagic-detected type; Access Profiles can match `archive-download`.
</Tip>

## How to verify

1. Check module stats / Reports for content signature load or download status.
2. After editing rows, confirm `content4.xml` under `/var/lib/safesquid/content_signatures/` updates.
3. For live tagging, verify `response_profiles` in Detailed logs, not content signature hooks.

## See also

* [Response Types](/admin_guide/policies_and_profiles/response_types)
* [DLP](/admin_guide/security_scanners/dlp)
* [Application Signatures](/admin_guide/policies_and_profiles/application_signatures)
* [Cloud / categorisation feeds](/admin_guide/start_here/cloud_feeds)
* [Logging and troubleshooting](/admin_guide/start_here/logging)

CLI: `man safesquid-contentSignatures`


## Related topics

- [Runtime Data and Signatures](/safesquid_swg/files_and_folders/runtime_data_and_signatures.md)
- [Cloud / categorisation feeds](/admin_guide/start_here/cloud_feeds.md)
- [Integrations](/admin_guide/start_here/integrations.md)
- [Tools and Reports](/admin_guide/start_here/tools_and_reports.md)
- [SafeSquid daemon](/admin_guide/start_here/daemon.md)