Headers

X-Content-Type-Options: nosniff. The one-line defensive header.

Published 2026-06-16 · Last updated 2026-06-16 · Vantyris editorial

What this means for your business

• Browsers used to 'sniff' a file's actual content whenever the server's declared Content-Type looked wrong or generic. That helped badly configured servers, and it also gave attackers an opening. An attacker who could upload a file containing HTML to a site that served it back with a generic Content-Type could get the browser to render it as HTML and run its scripts.
• X-Content-Type-Options: nosniff tells the browser to take the declared Content-Type at its word. A file the server says is image/png loads as an image. If it happens to contain HTML, the browser ignores that and renders nothing.
• Modern browsers sniff less aggressively than they used to, but an explicit nosniff is still the recommended security baseline. It costs nothing and shouldn't break anything that wasn't already broken.

How to fix

Add a single header to every response: X-Content-Type-Options: nosniff. Most web hosts have a 'security headers' setting that includes it as a default.

1. Check whether the header is already set. Open DevTools → Network, click any request to your site and look at Response Headers for x-content-type-options: nosniff. If it's there, you're done. If not, add it.
2. Add it at your web host or CDN. Apache: Header always set X-Content-Type-Options nosniff. Nginx: add_header X-Content-Type-Options nosniff always;. Next.js: in the headers function in next.config.mjs. Cloudflare: Rules → Transform Rules → Modify Response Header → add the header.
3. Verify in DevTools after deploy. Reload and check Response Headers again. The header should now appear.

Owner: Your web host or developer. · Time: 5 minutes.

Common gotchas

• If your site serves user-uploaded files (avatars, document uploads, etc.) with a Content-Type the browser doesn't recognise, nosniff makes the browser download them instead of trying to render them. That's usually what you want for security, though it can surprise users expecting a preview.
• If you also serve a separate static-asset domain (cdn.yourdomain.com), add the header there too. Headers don't carry across origins.
• Some legacy IE-targeted code relied on MIME sniffing to render content. If your site has a 2010-era jQuery plugin doing weird things with iframe contentTypes, test before assuming nosniff is safe. Almost no modern site has this problem.

How to verify the fix

A Vantyris verified scan checks for the header in the Web hygiene category. securityheaders.com grades the full defensive header set.

Cyber Essentials alignment

This finding informs the following Cyber Essentials control areas (the UK government's baseline scheme, a sound checklist in any country):

• A2. Secure configuration: devices and services hardened against the weaknesses they ship with by default.

Vantyris is not a CE certifying body. The mapping above is informational.

Common follow-up questions

References

• MDN: X-Content-Type-Options MDN
• OWASP secure-headers project OWASP

Related explainers

• Content Security Policy: the header that stops most XSS attacks dead.
• X-Frame-Options and frame-ancestors: the anti-clickjacking header.
• SameSite + Secure cookies: the two attributes every session cookie needs.