Security
X-Content-Type-Options
Prevents browsers from MIME-sniffing the content type, reducing the risk of drive-by downloads and XSS attacks.
Syntax
X-Content-Type-Options: nosniffExample
X-Content-Type-Options: nosniffDescription
The X-Content-Type-Options header with nosniff prevents the browser from guessing the MIME type. The browser will strictly follow the Content-Type declared by the server.
Without this header, browsers may examine content to determine the type, which attackers can exploit by uploading files with misleading extensions.
This header is simple to implement, has no compatibility issues, and is recommended by OWASP. Set it on every response.
Check if your website sends this header correctly
Check your headers →