X-Content-Type-Options

X-Content-Type-Options is an HTTP response header with a single defined value, nosniff. It tells the browser to trust the Content-Type your server sends instead of "sniffing" the content to guess something else.

Why it matters

Without it, a browser may decide that a file served as text/plain actually looks like HTML or JavaScript and execute it. If your site lets users upload files, an attacker could upload a script disguised as an image or text file and get it executed on your origin, leading to cross-site scripting.

With nosniff, browsers also refuse to run scripts and apply stylesheets whose MIME type is wrong. That is a useful signal, but it can surface latent misconfigurations, such as a JavaScript file served as text/html by a fallback error page.

Example

X-Content-Type-Options: nosniff

In nginx:

add_header X-Content-Type-Options "nosniff" always;

Then verify the real MIME type of your assets with curl -I https://example.com/app.js and look for Content-Type: application/javascript or text/javascript.

Common mistakes

• Adding the header without correcting wrong MIME types, which then breaks scripts.
• Omitting always in nginx so error responses lack it.
• Treating it as a replacement for validating uploads.

Related

• Security headers
• MIME type
• XSS
• Tool: Security headers checker

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.