Security Headers Checker / Headers
X-Content-Type-Options: nosniff
nosniff stops the browser from guessing a file's type from its contents. Without it, a file uploaded as an image but containing HTML or script can be run as such; with it, scripts and stylesheets are only used when their Content-Type is right.
What to send
X-Content-Type-Options: nosniff
nosniff is the only valid value. Check your server sends correct types for scripts (text/javascript) and stylesheets (text/css) before adding it.
# server { } block (or a file included in every server block).
# "always" also sends the header on error and redirect responses.
add_header X-Content-Type-Options "nosniff" always;Will this break anything?
- X-Content-Type-Options: browsers refuse scripts and stylesheets served with the wrong Content-Type (a script sent as text/plain): check your files are served with correct types.
How our grade counts it
- Coverage, up to 5 points: exactly nosniff
Common mistakes
- Any value other than nosniff: ignored.
- Scripts served as text/plain or application/octet-stream: they stop loading once nosniff is on.
Check your site
The checker reads X-Content-Type-Options the way a browser applies it, alongside every other security header.
Open the Security Headers Checker