Home / Knowledge hub / X-Content-Type-Options
Knowledge hub
X-Content-Type-Options
A header that stops browsers guessing a file's type and running it as a script.
What it means
X-Content-Type-Options is an HTTP response header with one useful value, nosniff. It tells the browser to trust the Content-Type your server declared and not to guess. Without it, a browser may look at the file's contents and decide it is something else.
With it, a file labelled as plain text stays plain text, and a script is only run when it is served as a script. The header also blocks stylesheet and script loads whose declared type does not match.
Why it matters
Guessing is how uploaded files turn into attacks. If a user uploads a file that looks like HTML or JavaScript but is labelled as an image or text, a browser that sniffs may run it. The script then executes on your domain, as a form of cross-site scripting.
The header costs nothing and closes that route. It is one of the headers security scanners and customer questionnaires check first, so its absence is easy to spot and tends to cost time in reviews.
How it shows up
You meet it in the response headers of nearly every well-run site, usually set in the web server, CDN or framework config as X-Content-Type-Options: nosniff. Check it on pages, API responses and especially on any route that serves user uploads.
The mistakes repeat. Setting it on the main site but not on the upload or asset domain. Serving files with a missing or wrong Content-Type, which the header then turns into a broken page. Assuming the header replaces proper upload validation. It does not. See content sniffing and security headers.
Questions people ask
X-Content-Type-Options, answered
Does nosniff stop all XSS?
No. It prevents one route: a file being run as a script because the browser guessed. Injected scripts in your own pages need output encoding and a content security policy.
Treat it as one layer.
Can it break my site?
If you serve scripts or styles with the wrong Content-Type, the browser will refuse to run them once nosniff is on.
Fix the type, not the header. Test in staging first.
What value does it take?
Only nosniff is defined. Any other value does nothing.
Send it on every response, not only on HTML.
Is it needed for API responses?
Yes, it is harmless and helps when a response is ever rendered by a browser, for example JSON with an HTML-looking error page.
Most frameworks let you set it globally.
How do we check it is set?
Open the browser's network panel or run a header check on a page, an API call and an uploaded file URL.
A pentest includes this and ties missing headers to actual impact where there is one.
Sources
Where this comes from
Related
Terms that sit next to this one
Content sniffing
A browser guessing a file's real type, which can turn an upload into a script.
Security headers
Response headers that switch on browser protections against common web attacks.
XSS
An attacker's script running in your pages, in your customers' sessions.
Content Security Policy
A header telling the browser which scripts a page may load.
HSTS
A header telling browsers to use HTTPS only for your site, every time.
Can a browser run your upload?
Uploaded files that a browser will run as scripts, and missing headers on the routes that serve them, are tested on the running app and proven rather than just listed. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.