Support Library

X-Content-Type-Options: nosniff

Every file a server sends carries a Content-Type that says what it is. Browsers have long second-guessed that label and “sniffed” the content instead. The header X-Content-Type-Options: nosniff tells them to trust the label, which stops a file from being run as something it is not.

Author
CategoryWebsite Security
Length4 minute read
UpdatedNovember 1, 2026

The short answer

Send this header on every response, and make sure your server labels files correctly:

X-Content-Type-Options: nosniff

With it, browsers refuse to run a script or apply a stylesheet unless the file is served with a JavaScript or CSS content type.

What sniffing can do

MIME sniffing with and without the nosniff header Top, without nosniff: an attacker uploads a file named avatar.png that actually contains JavaScript. The site serves it with a generic content type. A page the attacker controls loads it with a script tag, and a browser that sniffs the content may run it as a script. Bottom, with nosniff: the same file is served with nosniff, the browser sees it is not labelled as JavaScript and refuses to run it. Without nosniff Attacker uploads “avatar.png” Really contains script Site serves it Labelled text/plain Loaded as a script By a page the attacker controls Browser may run it Content looks like code Uploaded files can become scripts Text can be shown as HTML in old browsers With nosniff Attacker uploads The same file Site serves it With nosniff set Browser checks type Not a JavaScript type Refused Script never runs The declared type is final Mislabelled files are refused MIME sniffing with and without the nosniff header Top, without nosniff: an attacker uploads a file named avatar.png that actually contains JavaScript. The site serves it with a generic content type. A page the attacker controls loads it with a script tag, and a browser that sniffs the content may run it as a script. Bottom, with nosniff: the same file is served with nosniff, the browser sees it is not labelled as JavaScript and refuses to run it. Without nosniff Attacker uploads “avatar.png” Really contains script Site serves it Labelled text/plain Loaded as a script By a page the attacker controls Browser may run it Content looks like code Uploaded files can become scripts Text can be shown as HTML in old browsers With nosniff Attacker uploads The same file Site serves it With nosniff set Browser checks type Not a JavaScript type Refused Script never runs The declared type is final Mislabelled files are refused
Sniffing lets a browser decide a file is code even when the server said otherwise. nosniff removes that guess.

How DNS Panopticon detects it

Security Posture reads the X-Content-Type-Options header on your homepage. The result appears on the Website Application Security card.

FindingSeverityWhen it appears
No X-Content-Type-Options: nosniffLowThe header is missing or has a value other than nosniff.
MIME sniffing is offPassX-Content-Type-Options: nosniff is set.

The homepage stands in for the site. The header matters most on user uploads, downloads and API responses, so check those paths too.

How to check it yourself

CommandWhat to look for
curl -sI https://example.comAn x-content-type-options: nosniff line.
curl -sI https://example.com/uploads/sample.pngThe same header, and a correct content-type, on files users can upload.

In browser developer tools, a script blocked because of nosniff shows a console error such as “Refused to execute script … because its MIME type (‘text/plain’) is not executable, and strict MIME type checking is enabled.”

Why it matters

  • Uploads become code. Sites that accept files, such as avatars, attachments or documents, can end up serving attacker-written content from their own domain. Without nosniff, that content may be run as a script or treated as a stylesheet.
  • Same-origin trust. A script served from your domain is trusted by your pages’ security rules, so it is far more useful to an attacker than one from elsewhere.
  • Cross-origin data leaks. nosniff also helps browsers apply Cross-Origin Read Blocking, which keeps other sites from pulling your JSON or HTML into their pages.

Modern browsers already refuse to run scripts labelled as images, audio, video or CSV, which is why this finding is rated low. The header closes the remaining gaps and costs nothing.

How to fix it

  1. Add the header to every response at the web server, CDN or application.
  2. Check content types. Scripts must be served as text/javascript, stylesheets as text/css. With nosniff on, a mislabelled file stops working, so test the site after enabling it.
  3. Serve uploads safely. Store user files on a separate domain where possible, set the real content type, and add Content-Disposition: attachment for files that should download rather than open.
PlatformSetting
nginxadd_header X-Content-Type-Options "nosniff" always;
ApacheHeader always set X-Content-Type-Options "nosniff" (needs mod_headers)
IISIn web.config, under system.webServer/httpProtocol/customHeaders: <add name="X-Content-Type-Options" value="nosniff" />
CloudflareRules → Transform Rules → Modify Response Header, set the header on all requests
NetlifyIn _headers: a /* line, then X-Content-Type-Options: nosniff indented below it
Application codeMiddleware such as Helmet (Express) or the response headers settings of your framework

FAQ

Can nosniff break my site?

Only if a script or stylesheet is served with the wrong content type, for example a .js file served as text/plain. The browser console names the file; fix its content type on the server.

Is nosniff the only valid value?

Yes. The header has a single value, nosniff. Anything else is ignored.

Do I still need it if I have a Content-Security-Policy?

Yes. They solve different problems: CSP limits where scripts may come from, nosniff makes sure a file from an allowed place is only used as what it was labelled.

Sources and further reading

Related support articles

Content-Security-PolicyClickjacking and frame-ancestorsReferrer-PolicyMixed Content