DevToolsmith

X-Content-Type-Options Header

The X-Content-Type-Options response header stops browsers from guessing (“sniffing”) a response’s type instead of trusting Content-Type.

Type
Response header
Category
Security
Defined in
Fetch Standard

Syntax

X-Content-Type-Options: nosniff

How X-Content-Type-Options works

With nosniff, a script or stylesheet sent with the wrong Content-Type is blocked, and browsers won’t treat an uploaded text file as HTML. It has one value and no downside on a correctly configured server, so send it on every response.

Examples

The only valid value
X-Content-Type-Options: nosniff

Common mistakes

  • After enabling it, wrong Content-Types become hard errors, such as “Refused to execute script because its MIME type is not executable”. Fix the server’s MIME table rather than removing the header.

Check it

curl -sI https://example.com | grep -i '^x-content-type-options:'

Paste a full set of response headers into the HTTP header checker to get every header explained and common mistakes flagged.

Related headers

  • Content-Type: states the media type (MIME type) of the body, and for text, its character encoding.
  • Content-Security-Policy: restricts where a page may load scripts, styles, images and other resources from, to contain XSS.
  • Cross-Origin-Resource-Policy: says which sites may load this resource with no-cors requests such as <img> and <script> (CORP).

More security headers

Strict-Transport-Security , X-Frame-Options , Referrer-Policy , Permissions-Policy , Cross-Origin-Opener-Policy , Cross-Origin-Embedder-Policy .

Sources

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions

What does the X-Content-Type-Options header do?

The X-Content-Type-Options response header stops browsers from guessing (“sniffing”) a response’s type instead of trusting Content-Type. With nosniff, a script or stylesheet sent with the wrong Content-Type is blocked, and browsers won’t treat an uploaded text file as HTML. It has one value and no downside on a correctly configured server, so send it on every response.

How do I see the X-Content-Type-Options header?

Run "curl -sI https://example.com" to print a response’s headers, or open the Network tab in your browser’s dev tools and select the request. Paste the headers into the HTTP header checker on this site to get each one explained.