X-Content-Type-Options guide

X-Content-Type-Options: Understanding the nosniff Directive

X-Content-Type-Options is the simplest of the common security headers. It has one useful value, nosniff, and its job is to stop browsers second-guessing the file type your server declared.

It is easy to set and rarely breaks anything — provided your server is already declaring accurate content types.

Check your website security headers

What MIME sniffing is

Every response your server sends carries a Content-Type header describing what the content is: an HTML page, a stylesheet, a script, an image. Historically browsers would inspect the content itself and override that declaration if it looked wrong, a behaviour known as MIME sniffing.

That was convenient for badly configured servers and unhelpful for security. If a file that is supposed to be a harmless upload is sniffed as a script, it may be executed in the visitor's browser in the context of your site.

What nosniff does

Sending X-Content-Type-Options: nosniff tells the browser to take the declared Content-Type at face value and not to substitute its own guess. In particular, browsers will refuse to execute a response as a script or apply it as a stylesheet when the declared type does not match.

It is a small, well-contained control. It does not inspect your content, validate uploads or prevent a file from being uploaded in the first place.

Correct Content-Type values still matter

Because nosniff makes browsers trust your declaration, an incorrect declaration becomes more visible. A stylesheet served as text/plain, for example, will simply not be applied once nosniff is in force.

Before enabling it, check that your server returns accurate types for HTML, CSS, JavaScript, JSON, fonts and any file downloads you offer. User-uploaded files deserve particular attention, as they are the case the header is most often intended to cover.

How to check X-Content-Type-Options

Press F12 in Chrome, open the Network tab, reload the page and read the document request's Response Headers. If X-Content-Type-Options is absent, the most common explanation is simply that nobody has configured it — it is not usually removed deliberately.

Run the free website security check to see whether your public pages return the header alongside the other externally visible signals we review.

Check your website security headers

ScoutLab's free website security check looks at whether these headers are present and how they are configured on your public site, alongside HTTPS, DNS and email protection signals. It reports what it observes so you can discuss the results with whoever maintains your website.

Run the free website security check

Keep reading

Security headers explained: the full ScoutLab guideStart with the hub guide for how the main browser-facing response headers fit together.

X-Frame-Options guideThe other short, easily configured header most sites are asked about.

Run the free website security checkSee which of these headers your site currently returns.

Frequently asked questions

What is X-Content-Type-Options?

It is an HTTP response header whose nosniff value tells browsers not to guess the type of a response. The browser uses the Content-Type your server declared instead of inspecting the content and overriding it, which limits a class of attacks based on files being interpreted as scripts.

What does nosniff actually prevent?

It prevents MIME sniffing, where a browser reinterprets a response as a different type from the one declared. With nosniff in place, browsers will not execute a response as JavaScript or apply it as CSS when the declared Content-Type does not match, which reduces the risk from user-uploaded or mislabelled files.

Can nosniff break my website?

It can expose existing mistakes. If your server declares an incorrect Content-Type for a stylesheet or script, the browser will no longer quietly compensate and the resource may stop working. Verify that your content types are accurate before enabling the header.

What does a missing X-Content-Type-Options header mean?

Usually that nobody has configured it. It is not enabled by default on many servers and platforms, so its absence is a common finding on otherwise well-maintained sites rather than a sign of a specific problem.

Technical references

Security headers are browser-facing HTTP response controls and one layer of defence. They work alongside patching, access control, backups and monitoring rather than replacing them.