Security · Response header

X-Content-Type-Options

Disables MIME-type sniffing.

What is X-Content-Type-Options?

With `nosniff`, browsers refuse to interpret files as a type other than the declared Content-Type — mitigating the class of attacks where a user-uploaded image is served and executed as JavaScript.

Typical usage

Set on every response.

Examples

X-Content-Type-Options: nosniff

Specification

Fetch Standard

Related headers

Strict-Transport-Security

Force browsers to use HTTPS for a domain (HSTS).

Content-Security-Policy

The primary defense against XSS: whitelist trusted sources.

X-Frame-Options

Prevents clickjacking by controlling framing.

Referrer-Policy

Controls the Referer header sent on outgoing links and requests.

Permissions-Policy

Controls which browser features and APIs pages can use.