# X-Content-Type-Options Header — Syntax, Values & Examples

> With nosniff, stops browsers guessing a response's type, so a text file can't be run as a script.

Browsers used to guess a resource's type from its contents when the `Content-Type` looked wrong. Attackers abused that: upload a file that passes as an image but contains JavaScript, then load it as a script. `nosniff` makes browsers trust the declared type, and refuse scripts and stylesheets served with the wrong one.

- Type: Response header
- Category: Security
- Defined in: [Fetch Standard — X-Content-Type-Options](https://fetch.spec.whatwg.org/#x-content-type-options-header)

## Syntax

```http
X-Content-Type-Options: nosniff
```

## Examples

```http
X-Content-Type-Options: nosniff
```

the only valid value

## Good to know

- With nosniff, a script served as `text/plain` is blocked — make sure JavaScript goes out as `text/javascript` and CSS as `text/css`.
- Send it on every response; it's harmless where it doesn't apply.

## How to set X-Content-Type-Options

### Express

```
res.set("X-Content-Type-Options", "nosniff");
```

### Next.js (next.config.js)

```
module.exports = {
  async headers() {
    return [
      {
        source: "/(.*)",
        headers: [{ key: "X-Content-Type-Options", value: "nosniff" }],
      },
    ];
  },
};
```

### nginx

```
add_header X-Content-Type-Options "nosniff" always;
```

### Apache (.htaccess)

```
Header always set X-Content-Type-Options "nosniff"
```

## Check it

Fetch only the response headers and filter for X-Content-Type-Options. In the browser, it's under Response Headers in DevTools → Network.

```sh
curl -sI https://example.com/ | grep -i '^x-content-type-options:'
```

## FAQ

### Why did a script stop loading after I added nosniff?

The server sends it with the wrong Content-Type — often text/plain or application/octet-stream. Fix the MIME type for .js files.

## Related headers

- [Content-Type](https://www.devkult.com/headers/content-type.md): States the media type of the body — HTML, JSON, form data, an image — and often its character encoding.
- [Content-Security-Policy](https://www.devkult.com/headers/content-security-policy.md): Restricts where a page may load scripts, styles, images and frames from — the main defence against cross-site scripting.
- [X-Frame-Options](https://www.devkult.com/headers/x-frame-options.md): Controls whether the page may be shown inside a frame, protecting against clickjacking.

## Further reading

- [Security headers checklist](https://www.devkult.com/blog/security-headers-checklist.md)
- [MIME types by file extension](https://www.devkult.com/mime.md)

Open the interactive page: https://www.devkult.com/headers/x-content-type-options