How to add X-Content-Type-Options on Lovable / static hosting

Last updated November 11, 2026 · Reviewed by a CISSP-certified security practitioner

To add X-Content-Type-Options on Lovable / static hosting, set the header in src/server.ts (TanStack Start) or your edge proxy with the value nosniff. Stops browsers from guessing (sniffing) file types. Publish, then curl -I your live domain. Then confirm it with curl -I or a free FixSecurityHeaders scan.

What does X-Content-Type-Options do?

Setting nosniff makes the browser trust the Content-Type you send instead of guessing, so an uploaded text file can't be executed as script.

Risk if missing: MIME sniffing can turn user uploads or JSON responses into executable scripts or styles.

What is the Lovable / static hosting configuration?

Add this to src/server.ts (TanStack Start) or your edge proxy:

src/server.ts (TanStack Start) or your edge proxy

// src/server.ts — wrap the response before returning it
function withSecurityHeaders(res: Response): Response {
  const out = new Response(res.body, res);
  const h = out.headers;
  h.set("X-Content-Type-Options", "nosniff");
  return out;
}

How do I add it step by step?

Open src/server.ts (TanStack Start) or your edge proxy.
Paste the X-Content-Type-Options configuration shown below.
Publish, then curl -I your live domain.
Run curl -I https://yourdomain.com and look for the x-content-type-options line.
Scan your site on FixSecurityHeaders to confirm the grade improved.

How do I verify it worked?

terminal

curl -sI https://yourdomain.com | grep -i "x-content-type-options"
# expected:
# x-content-type-options: nosniff

Check your site now

Free scan, instant grade, exact fixes for your stack.

What are the common mistakes?

Make sure your server sends correct Content-Type headers, or some assets will stop loading.
Pure static hosts that don't allow custom headers can be fronted by Cloudflare to add them.
Skip frame-blocking headers on preview URLs that are shown inside editors.

Quick reference

Header	`X-Content-Type-Options`
Recommended value	`nosniff`
Stack	Lovable / static hosting
Where	src/server.ts (TanStack Start) or your edge proxy
Compliance	OWASP ASVS V14.4.4, SOC 2 CC6.8

FAQ

What value should I use for X-Content-Type-Options?

A safe default is nosniff. Make sure your server sends correct Content-Type headers, or some assets will stop loading.

Why isn't X-Content-Type-Options showing up on Lovable / static hosting?

Pure static hosts that don't allow custom headers can be fronted by Cloudflare to add them. Also clear any CDN or page cache, and check you edited the config that actually serves your domain.

Does X-Content-Type-Options affect SEO or performance?

No measurable performance cost — it's a few bytes per response. It doesn't affect rankings directly, but a misconfigured policy can break page resources, so test before enforcing.

Which compliance frameworks reference X-Content-Type-Options?

OWASP ASVS V14.4.4, SOC 2 CC6.8.