The X-Content-Type-Options header with the value nosniff instructs browsers to honour the declared Content-Type of a response and not attempt to guess (sniff) the content type. This prevents MIME-confusion attacks where an attacker tricks a browser into executing a file as a script by exploiting loose type detection.
The Only Value You Need
http
X-Content-Type-Options: nosniffnosniff is the only valid value for this header. It is a simple, one-line addition with no configuration needed beyond enabling it.
Always Set the Correct Content-Type
nosniff relies on your server sending the correct Content-Type for each resource. If your server sends text/plain for a JavaScript file, the browser will refuse to execute it. Ensure your MIME types are correctly configured alongside this header.Set the Header on Your Server
Nginx
nginx
server {
listen 443 ssl;
server_name example.com;
add_header X-Content-Type-Options "nosniff" always;
# ... rest of config
}bash
sudo nginx -t && sudo systemctl reload nginxApache
apache
<VirtualHost *:443>
<IfModule mod_headers.c>
Header always set X-Content-Type-Options "nosniff"
</IfModule>
</VirtualHost>Or in .htaccess:
apache
<IfModule mod_headers.c>
Header always set X-Content-Type-Options "nosniff"
</IfModule>bash
sudo a2enmod headers && sudo systemctl reload apache2IIS
xml
<system.webServer>
<httpProtocol>
<customHeaders>
<add name="X-Content-Type-Options" value="nosniff" />
</customHeaders>
</httpProtocol>
</system.webServer>Caddy
Command
example.com {
header X-Content-Type-Options "nosniff"
# ... rest of config
}Cloudflare
- Go to Rules → Transform Rules → Modify Response Header.
- Add a rule with Operation: Set, Header name: X-Content-Type-Options, Value: nosniff.
- Deploy the rule.
Next.js
javascript
// next.config.mjs
const nextConfig = {
async headers() {
return [
{
source: '/(.*)',
headers: [
{ key: 'X-Content-Type-Options', value: 'nosniff' },
],
},
];
},
};
export default nextConfig;Verifying the Header
bash
curl -I https://example.com | grep -i x-content-type
# Expected: x-content-type-options: nosniffOr use the ShowDNS Security Headers Scanner.