X-Content-Type-Options
Prevents browsers from MIME-sniffing the content type, reducing the risk of drive-by downloads and XSS attacks.
Syntax
X-Content-Type-Options: nosniffExample
X-Content-Type-Options: nosniffDescription
The X-Content-Type-Options header with nosniff prevents the browser from guessing the MIME type. The browser will strictly follow the Content-Type declared by the server.
Without this header, browsers may examine content to determine the type, which attackers can exploit by uploading files with misleading extensions.
This header is simple to implement, has no compatibility issues, and is recommended by OWASP. Set it on every response.
How real sites send this header
Home-page responses of 503 popular sites from the enterno.io /check catalogue, checked in the last 30 days.
51.3%
(258 of 503) send X-Content-Type-Options.
Most common values:
nosniff— 257 sites
See it on: yandex.ru, discord.com, github.com, habr.com, cloudflare.com
Check if your website sends this header correctly
Check your headers →