Security · Response header
X-Content-Type-Options
Disables MIME-type sniffing.
What is X-Content-Type-Options?
With `nosniff`, browsers refuse to interpret files as a type other than the declared Content-Type — mitigating the class of attacks where a user-uploaded image is served and executed as JavaScript.
Typical usage
Set on every response.
Examples
X-Content-Type-Options: nosniffSpecification
Fetch Standard
Frequently asked questions
What is the X-Content-Type-Options HTTP header?
With `nosniff`, browsers refuse to interpret files as a type other than the declared Content-Type — mitigating the class of attacks where a user-uploaded image is served and executed as JavaScript.
Is X-Content-Type-Options a request or response header?
X-Content-Type-Options is a response header — the server sends it to the client. Set on every response.
What does a X-Content-Type-Options header look like?
A typical X-Content-Type-Options header looks like: X-Content-Type-Options: nosniff.
Related headers
Strict-Transport-Security
Force browsers to use HTTPS for a domain (HSTS).
Content-Security-Policy
The primary defense against XSS: whitelist trusted sources.
X-Frame-Options
Prevents clickjacking by controlling framing.
Referrer-Policy
Controls the Referer header sent on outgoing links and requests.
Permissions-Policy
Controls which browser features and APIs pages can use.