X-Content-Type-Options explained

Last updated November 11, 2026 · Reviewed by a CISSP-certified security practitioner

X-Content-Type-Options: Setting nosniff makes the browser trust the Content-Type you send instead of guessing, so an uploaded text file can't be executed as script. Recommended value: nosniff.

What risk does it prevent?

MIME sniffing can turn user uploads or JSON responses into executable scripts or styles.

What is the safe recommended value?

X-Content-Type-Options: nosniff

What are the gotchas?

Make sure your server sends correct Content-Type headers, or some assets will stop loading.

Which compliance controls reference it?

OWASP ASVS V14.4.4
SOC 2 CC6.8

How do I add it on my stack?

Check your site now

Free scan, instant grade, exact fixes for your stack.

Other security headers

Strict-Transport-Security — Forces browsers to only use HTTPS for your domain.
Content-Security-Policy — Controls which scripts, styles and frames a page may load.
X-Frame-Options — Prevents your site being embedded in iframes (clickjacking).
Referrer-Policy — Limits how much of your URLs leak to other sites.
Permissions-Policy — Turns off browser features (camera, mic, geolocation) you don't use.
Cross-Origin-Opener-Policy — Isolates your window from pop-ups and openers on other sites.
Cross-Origin-Resource-Policy — Stops other sites from loading your resources.
Cross-Origin-Embedder-Policy — Requires embedded resources to opt in (enables cross-origin isolation).