What does X-Content-Type-Options: nosniff do?

It stops the browser from guessing a file type. A script or stylesheet served with the wrong Content-Type is refused instead of run, which closes off attacks that upload a file and get it executed as script.

What values can it take?

Only nosniff. Anything else is ignored by browsers.

Can it break my site?

Only where a script or stylesheet is served with a wrong Content-Type, such as text/plain. Fix that type on the server and the file loads again.

What does EngineeringScore check?

That the header is present on the page response. It does not read the value, so check by hand that it says nosniff.

Security Small

X-Content-Type-Options nosniff: how to add it

Add X-Content-Type-Options header

Without X-Content-Type-Options: nosniff, some browsers will try to guess a resource's type by inspecting its contents rather than trusting the declared Content-Type. That "MIME sniffing" behavior is a legacy compatibility feature, but it also gives attackers a way to get a browser to execute a file (like a user-uploaded image) as if it were a script.

Find out whether your site has this problem, and every other check, in one free scan.

Check your site free

Why it matters

Without nosniff, browsers may reinterpret a file as a different type, for example treating an uploaded image as executable JavaScript, which attackers can exploit to run malicious scripts.

How to fix

1 Add X-Content-Type-Options: nosniff to all responses.
2 Ensure correct Content-Type headers are already being sent for every resource.

Fix it in your stack

Nginx

The server block.

# server block, HTTPS site
add_header X-Content-Type-Options "nosniff" always;

Apache

The virtual host or .htaccess.

# .htaccess or virtual host, mod_headers enabled
Header always set X-Content-Type-Options "nosniff"

Next.js

next.config.js, for every path.

// next.config.js
module.exports = {
  async headers() {
    return [{ source: '/:path*', headers: [{ key: 'X-Content-Type-Options', value: 'nosniff' }] }];
  },
};

Node.js (Express)

helmet() sends it by default; on its own:

app.use(helmet.noSniff());

Common mistakes

Adding the header only to HTML responses and forgetting it needs to apply site-wide, including to user-uploaded content and API responses.
Assuming nosniff alone is sufficient protection against the underlying upload-handling risk, when the real fix also requires sending correct Content-Type headers everywhere.
Setting the header at the CDN but not at the origin, so it silently disappears if a request ever bypasses the CDN.

How to verify

1 Inspect the response headers for X-Content-Type-Options: nosniff on both HTML pages and static assets.
2 Check that every response, including file uploads and API endpoints, declares an accurate Content-Type so nosniff cannot expose a mismatch.
3 Re-run a header scanner site-wide, not just on the homepage, since headers are often set per-route rather than globally.

Questions

What does X-Content-Type-Options: nosniff do?: It stops the browser from guessing a file type. A script or stylesheet served with the wrong Content-Type is refused instead of run, which closes off attacks that upload a file and get it executed as script.
What values can it take?: Only nosniff. Anything else is ignored by browsers.
Can it break my site?: Only where a script or stylesheet is served with a wrong Content-Type, such as text/plain. Fix that type on the server and the file loads again.
What does EngineeringScore check?: That the header is present on the page response. It does not read the value, so check by hand that it says nosniff.

Ready to see where you stand?

Scan your site and get your Engineering Score with a prioritized roadmap in under a minute, no signup required.

Scan your site