Medium Security Header

X-Content-Type-Options

Understand how X-Content-Type-Options prevents MIME sniffing attacks and improves content security.

SiteSecurityScore Team·7 min read·Updated Feb 20, 2026

X-Content-Type-Options is a HTTP response header that prevents browsers from MIME sniffing a response away from the declared Content-Type. This security feature helps prevent attacks where malicious content is disguised as harmless files. Despite being one of the simplest security headers to implement (it has only one valid value), it plays a critical role in your defense strategy by ensuring browsers always respect your declared content types.

What is MIME Sniffing?#

MIME sniffing (also called content sniffing) is a browser behavior where the browser examines the raw bytes of a response to determine its content type, rather than trusting the Content-Type header sent by the server. This behavior was introduced to handle situations where servers sent incorrect Content-Type headers, but it creates a significant security risk when attackers can exploit it.

Browsers may ignore the Content-Type header and execute content based on detected patterns
A file served as text/plain could be reinterpreted as HTML or JavaScript
User uploaded content is especially vulnerable to MIME sniffing attacks
Different browsers implement MIME sniffing algorithms differently, creating inconsistent behavior

How It Works

When a browser receives a response, it can compare the declared Content-Type against the actual content bytes. If the browser detects that the content looks like HTML or JavaScript, it may execute it regardless of what the server declared. This is the core vulnerability that X-Content-Type-Options addresses.

Security Risks of MIME Sniffing#

Without X-Content-Type-Options, attackers can exploit MIME sniffing to execute malicious code in the context of your website. This is particularly dangerous on sites that allow user uploads or serve user generated content. The attack typically involves uploading a file that contains valid JavaScript or HTML disguised as an innocent file type.

Cross-Site Scripting (XSS) through uploaded files that browsers reinterpret as HTML
Drive-by downloads where executables are served with misleading Content-Types
Privilege escalation when scripts execute in your site's origin context
Data exfiltration through injected scripts that access cookies and session data

Real World Attack Scenario

An attacker uploads an image file to your site that actually contains JavaScript. The server stores and serves it as image/png, but without nosniff, a browser might detect the embedded script content and execute it. This gives the attacker full XSS capability within your domain.

How X-Content-Type-Options Works#

The X-Content-Type-Options header has exactly one valid value: nosniff. When set, it instructs the browser to strictly follow the MIME type declared in the Content-Type header and never attempt to sniff the content. This applies to two main scenarios: script and style loading, and general navigation requests.

For script requests, the browser will block responses with non-JavaScript MIME types
For style requests, the browser will block responses with non-CSS MIME types
The header prevents the browser from overriding declared types for all resource loads
Modern browsers enforce nosniff by default for certain resource types, but the header ensures consistent behavior

Implementation Guide#

Adding X-Content-Type-Options is straightforward since there is only one valid configuration. Here are examples for common web servers and frameworks. Always ensure this header is set on all responses, not just HTML pages.

Framework Support

Most modern web frameworks include middleware or built-in support for security headers. Helmet.js for Express, Django SecurityMiddleware, and Spring Security all set X-Content-Type-Options by default.

Configuration

# Apache (.htaccess or httpd.conf)
Header always set X-Content-Type-Options "nosniff"

# Nginx
add_header X-Content-Type-Options "nosniff" always;

# Node.js / Express
app.use((req, res, next) => {
  res.setHeader('X-Content-Type-Options', 'nosniff');
  next();
});

# IIS (web.config)
<system.webServer>
  <httpProtocol>
    <customHeaders>
      <add name="X-Content-Type-Options" value="nosniff" />
    </customHeaders>
  </httpProtocol>
</system.webServer>

MDN: X-Content-Type-Options

Testing and Verification#

After implementing X-Content-Type-Options, you should verify it is working correctly across all your responses. Here are several methods to confirm proper configuration.

Use browser Developer Tools (Network tab) to inspect response headers on any page
Run a scan with SiteSecurityScore to verify the header is present and correctly configured
Use curl to check headers from the command line: curl -I https://yoursite.com
Test with multiple content types to ensure the header appears on all responses, not just HTML

Configuration

# Quick verification with curl
curl -I https://yoursite.com 2>/dev/null | grep -i x-content-type-options
# Expected output: X-Content-Type-Options: nosniff

Best Practices and Common Mistakes#

While X-Content-Type-Options is simple to implement, there are several best practices to follow and common mistakes to avoid for maximum effectiveness.

Always set correct Content-Type headers on your responses before enabling nosniff
Apply the header to all responses, including API endpoints and static assets
Combine with Content-Security-Policy for defense in depth against content injection
Ensure your CDN or reverse proxy forwards the header correctly to clients
Audit uploaded files server-side rather than relying solely on browser protections

Common Mistake

If you enable nosniff but serve files with incorrect Content-Type headers, browsers will refuse to load those resources. For example, a CSS file served as text/plain will not be applied, and a JavaScript file served as text/html will not execute. Always verify your Content-Type headers are correct before deploying.

Implementation Examples#

Prevent MIME Sniffing

X-Content-Type-Options: nosniff

Instructs browsers to strictly follow the Content-Type header

Explanation: This is the only valid value for X-Content-Type-Options. It tells browsers to not perform MIME sniffing and to respect the Content-Type header.