Security headers

How to fix: X-Content-Type-Options header

X-Content-Type-Options: nosniff tells the browser to trust the Content-Type your server sends instead of guessing a file's type from its contents.

Not sure whether your site has this problem? Check it in seconds.

Security Headers checker Run a free audit

Why it matters

Content sniffing can make a browser treat an uploaded file as a script or stylesheet even though your server labelled it something harmless. nosniff turns that behaviour off.

How to check

Look for X-Content-Type-Options: nosniff in the response headers.

How to fix it

Header value

X-Content-Type-Options: nosniff

Nginx

add_header X-Content-Type-Options "nosniff" always;

Apache

Header always set X-Content-Type-Options "nosniff"

Next.js (next.config.ts)

const nextConfig = {
  async headers() {
    return [
      {
        source: "/:path*",
        headers: [{ key: "X-Content-Type-Options", value: "nosniff" }],
      },
    ];
  },
};
export default nextConfig;

Common mistakes

Setting nosniff while serving files with the wrong Content-Type (for example JavaScript as text/plain): the browser will then refuse to run them. Fix the MIME types.

Frequently asked questions

Is there more than one valid value?

No. nosniff is the only value browsers recognise.

Related guides

Guidance is general. Test header and DNS changes on a staging copy first, and check your hosting provider's documentation for platform-specific steps.