Glossary
SECURITY HEADERS

X-Content-Type-Options

An HTTP response header with a single value 'nosniff' that stops browsers from MIME-sniffing responses. Blocks the class of attacks that turn an image into an executable script.

X-Content-Type-Options is a single-purpose HTTP response header that tells browsers to not MIME-sniff responses away from their declared Content-Type. The only valid value is nosniff.

Header Format

X-Content-Type-Options: nosniff

What MIME Sniffing Is

Some browsers, historically, would look at the first bytes of a response and infer the “real” content type — treating a .txt file with HTML tags as HTML. This enabled attackers to upload files disguised as images (.jpg) that contained executable JavaScript.

Impact of nosniff

  • Content-Type: text/plain — treated as text, never as HTML/JS, no matter what’s in the body
  • Content-Type: image/png on something that isn’t a PNG — rendered broken, never as HTML
  • Blocks a full class of file-upload exploits

Recommendation

Set this header on every response. There is no downside, no compatibility risk, and no configuration to tune. Always nosniff.

Validate with the security headers checker.

Check the CSP glossary entry, the HSTS glossary entry, and read the HTTP security headers explainer.

← All terms Learning hub →