Skip to content
FixSecurityHeadersScan a site

How to add X-Content-Type-Options on Cloudflare

Last updated · Reviewed by a CISSP-certified security practitioner

To add X-Content-Type-Options on Cloudflare, set the header in Rules → Transform Rules → Modify Response Header (or a Worker) with the value nosniff. Stops browsers from guessing (sniffing) file types. Purge cache, then check the response with curl -I. Then confirm it with curl -I or a free FixSecurityHeaders scan.

What does X-Content-Type-Options do?

Setting nosniff makes the browser trust the Content-Type you send instead of guessing, so an uploaded text file can't be executed as script.

Risk if missing: MIME sniffing can turn user uploads or JSON responses into executable scripts or styles.

What is the Cloudflare configuration?

Add this to Rules → Transform Rules → Modify Response Header (or a Worker):

Rules → Transform Rules → Modify Response Header (or a Worker)
// Option A: Rules → Transform Rules → Modify Response Header → "Set static"
//   X-Content-Type-Options: nosniff

// Option B: Cloudflare Worker
export default {
  async fetch(request, env, ctx) {
    const res = await fetch(request);
    const out = new Response(res.body, res);
    const h = out.headers;
    h.set("X-Content-Type-Options", "nosniff");
    return out;
  },
};

How do I add it step by step?

  1. Open Rules → Transform Rules → Modify Response Header (or a Worker).
  2. Paste the X-Content-Type-Options configuration shown below.
  3. Purge cache, then check the response with curl -I.
  4. Run curl -I https://yourdomain.com and look for the x-content-type-options line.
  5. Scan your site on FixSecurityHeaders to confirm the grade improved.

How do I verify it worked?

terminal
curl -sI https://yourdomain.com | grep -i "x-content-type-options"
# expected:
# x-content-type-options: nosniff

Check your site now

Free scan, instant grade, exact fixes for your stack.

What are the common mistakes?

  • Make sure your server sends correct Content-Type headers, or some assets will stop loading.
  • Transform Rules work on all plans; Workers give full control.
  • Cloudflare's own HSTS setting lives under SSL/TLS → Edge Certificates.

Quick reference

HeaderX-Content-Type-Options
Recommended valuenosniff
StackCloudflare
WhereRules → Transform Rules → Modify Response Header (or a Worker)
ComplianceOWASP ASVS V14.4.4, SOC 2 CC6.8

FAQ

What value should I use for X-Content-Type-Options?

A safe default is nosniff. Make sure your server sends correct Content-Type headers, or some assets will stop loading.

Why isn't X-Content-Type-Options showing up on Cloudflare?

Transform Rules work on all plans; Workers give full control. Also clear any CDN or page cache, and check you edited the config that actually serves your domain.

Does X-Content-Type-Options affect SEO or performance?

No measurable performance cost — it's a few bytes per response. It doesn't affect rankings directly, but a misconfigured policy can break page resources, so test before enforcing.

Which compliance frameworks reference X-Content-Type-Options?

OWASP ASVS V14.4.4, SOC 2 CC6.8.

Related guides