home/headers/x-content-type-options

X-Content-Type-Options

response headersecurity

With nosniff, stops browsers guessing a response's type, so a text file can't be run as a script.

Browsers used to guess a resource's type from its contents when the Content-Type looked wrong. Attackers abused that: upload a file that passes as an image but contains JavaScript, then load it as a script. nosniff makes browsers trust the declared type, and refuse scripts and stylesheets served with the wrong one.

Syntax

X-Content-Type-Options: nosniff

Defined in Fetch Standard — X-Content-Type-Options.

Examples

X-Content-Type-Options: nosniff

the only valid value

Good to know

With nosniff, a script served as text/plain is blocked — make sure JavaScript goes out as text/javascript and CSS as text/css.
Send it on every response; it's harmless where it doesn't apply.

Further reading: Security headers checklist · MIME types by file extension

How to set X-Content-Type-Options

Express

res.set("X-Content-Type-Options", "nosniff");

Next.js (next.config.js)

module.exports = {
  async headers() {
    return [
      {
        source: "/(.*)",
        headers: [{ key: "X-Content-Type-Options", value: "nosniff" }],
      },
    ];
  },
};

nginx

add_header X-Content-Type-Options "nosniff" always;

Apache (.htaccess)

Header always set X-Content-Type-Options "nosniff"

Check it

Fetch only the response headers and filter for X-Content-Type-Options. In the browser, it's under Response Headers in DevTools → Network.

curl -sI https://example.com/ | grep -i '^x-content-type-options:'

To compare response headers across many URLs at once, use the HTTP Status Checker.

Frequently asked questions

Why did a script stop loading after I added nosniff?

The server sends it with the wrong Content-Type — often text/plain or application/octet-stream. Fix the MIME type for .js files.