Skip to content
FixSecurityHeadersScan a site

How to add X-Content-Type-Options on AWS CloudFront

Last updated · Reviewed by a CISSP-certified security practitioner

To add X-Content-Type-Options on AWS CloudFront, set the header in Response headers policy with the value nosniff. Stops browsers from guessing (sniffing) file types. Attach the policy to the distribution's cache behavior and wait for deployment. Then confirm it with curl -I or a free FixSecurityHeaders scan.

What does X-Content-Type-Options do?

Setting nosniff makes the browser trust the Content-Type you send instead of guessing, so an uploaded text file can't be executed as script.

Risk if missing: MIME sniffing can turn user uploads or JSON responses into executable scripts or styles.

What is the AWS CloudFront configuration?

Add this to Response headers policy:

Response headers policy
// aws cloudfront create-response-headers-policy --response-headers-policy-config file://policy.json
{
  "Name": "fixsecurityheaders-policy",
  "SecurityHeadersConfig": {
    "ContentTypeOptions": {
      "Override": true
    }
  },
  "CustomHeadersConfig": {
    "Quantity": 0,
    "Items": []
  }
}

How do I add it step by step?

  1. Open Response headers policy.
  2. Paste the X-Content-Type-Options configuration shown below.
  3. Attach the policy to the distribution's cache behavior and wait for deployment.
  4. Run curl -I https://yourdomain.com and look for the x-content-type-options line.
  5. Scan your site on FixSecurityHeaders to confirm the grade improved.

How do I verify it worked?

terminal
curl -sI https://yourdomain.com | grep -i "x-content-type-options"
# expected:
# x-content-type-options: nosniff

Check your site now

Free scan, instant grade, exact fixes for your stack.

What are the common mistakes?

  • Make sure your server sends correct Content-Type headers, or some assets will stop loading.
  • AWS provides a managed SecurityHeadersPolicy, but a custom policy lets you set CSP.
  • Enable Override so origin headers don't win.

Quick reference

HeaderX-Content-Type-Options
Recommended valuenosniff
StackAWS CloudFront
WhereResponse headers policy
ComplianceOWASP ASVS V14.4.4, SOC 2 CC6.8

FAQ

What value should I use for X-Content-Type-Options?

A safe default is nosniff. Make sure your server sends correct Content-Type headers, or some assets will stop loading.

Why isn't X-Content-Type-Options showing up on AWS CloudFront?

AWS provides a managed SecurityHeadersPolicy, but a custom policy lets you set CSP. Also clear any CDN or page cache, and check you edited the config that actually serves your domain.

Does X-Content-Type-Options affect SEO or performance?

No measurable performance cost — it's a few bytes per response. It doesn't affect rankings directly, but a misconfigured policy can break page resources, so test before enforcing.

Which compliance frameworks reference X-Content-Type-Options?

OWASP ASVS V14.4.4, SOC 2 CC6.8.

Related guides