Skip to content

X-Content-Type-Options Header

Stops the browser from guessing a file's content type instead of trusting the server's declared Content-Type.

Last updated August 9, 2026.

Severity when missing: Low — see the missing-header finding on the security headers checker.

Check if your site sends this header

What it does

X-Content-Type-Options: nosniff disables MIME-type sniffing. Without it, some browsers will inspect a response's bytes and decide for themselves what kind of content it is, even if the server's `Content-Type` header says otherwise.

Why it matters

MIME sniffing has historically let attackers upload a file that is technically an image or text file but that a browser reinterprets as HTML or JavaScript and executes — turning an upload feature into a stored-XSS vector. It's a lower-severity header than HSTS or CSP because modern browsers sniff far less aggressively than they used to, but it's a one-line, zero-downside header with no legitimate reason to omit.

Example header

Example only — this is not evidence from a live scan.

X-Content-Type-Options: nosniff

How to test for it

  • Run `curl -sI https://example.com` and confirm `X-Content-Type-Options: nosniff` is present on both HTML pages and any user-uploaded or static file responses.
  • Check any endpoint that serves user-controlled uploads specifically — that's where sniffing-based attacks matter most.

How to add it

Nginx

add_header X-Content-Type-Options "nosniff" always;

Apache

Header always set X-Content-Type-Options "nosniff"

Cloudflare

Rules → Transform Rules → Modify Response Header → set `X-Content-Type-Options` to `nosniff`.

Verify the fix

After deploying the change, re-run a Nivaronix scan on your domain, or check with curl -sI https://your-domain.example, to confirm the header now appears in the response.

Back to all security header guidesWebsite security scanner

Standards reference

MDN — X-Content-Type-Options. For exactly how Nivaronix evaluates this header during a scan, see the methodology page.