X-Content-Type-Options
Prevents the browser from MIME-sniffing a response away from the declared Content-Type header, mitigating drive-by malware and MIME confusion attacks.
nosniffProduction Server Implementation
add_header X-Content-Type-Options "nosniff" always;Directives & Syntax Breakdown
Tells the browser to strictly trust the declared Content-Type header and reject executable files with mismatched MIME types.
Common Security Hazards & Pitfalls
- •Ensure server configurations set accurate Content-Type headers for .js (text/javascript) and .css (text/css), or browsers will block them.
X-Content-Type-Options - Questions & Answers
Common implementation questions, browser enforcement rules, and debugging.
If an attacker uploads a malicious script with an image extension (.jpg), a sniffing browser might execute it as HTML/JavaScript, leading to account takeover.
Related HTTP Headers
Browse All HeadersRestricts where scripts, images, styles, and frames can be loaded from, protecting websites from Cross-Site Scripting (XSS) and data injection attacks.
Forces modern web browsers to communicate exclusively over encrypted HTTPS connections, preventing SSL stripping and man-in-the-middle (MITM) attacks.
Indicates whether a browser should be allowed to render a page inside an <iframe>, <frame>, or <object>, protecting users against clickjacking attacks.
Controls how much referrer information (URL path and query parameters) is included when navigating away or loading external assets.
Allows site owners to selectively restrict browser hardware features, sensors, APIs, and privacy-invasive tracking mechanisms.
Specifies browser and CDN caching directives for requests and responses, dramatically accelerating load speeds or preventing cache leakage.