X-Content-Type-Options
X-Content-Type-Options: nosniff stops browsers from second-guessing (MIME-sniffing) the Content-Type you send. Without it, a browser may execute a file you served as text/plain as if it were JavaScript, enabling certain drive-by and content-injection attacks.
Why it matters
Prevents browsers from MIME-sniffing responses away from the declared Content-Type, blocking drive-by downloads.
How to add X-Content-Type-Options
add_header X-Content-Type-Options "nosniff" always;Recommended value
nosniffAvoid
(header absent) — browser is free to MIME-sniffFrequently asked questions
Does nosniff break anything?
Rarely. It only requires that your responses declare an accurate Content-Type. If a stylesheet or script is served with the wrong type it may stop loading — but that is a bug worth fixing anyway.
Is nosniff the only valid value?
Yes. The header has exactly one meaningful token, nosniff. Any other value is ignored.
Related reading
Other header guides
What the HSTS header does, how to configure max-age, includeSubDomains and preload, and how to add it in Nginx, Apache, and Cloudflare.
How X-Frame-Options prevents clickjacking, DENY vs SAMEORIGIN, why frame-ancestors supersedes it, and how to set it in Nginx, Apache, and Cloudflare.
The X-XSS-Protection header is a legacy filter that can introduce vulnerabilities. Learn why modern guidance is to set it to 0 and rely on CSP.
How Referrer-Policy limits the referrer data sent to other sites, the safest values, and how to configure it in Nginx, Apache, and Cloudflare.
Is X-Content-Type-Options set on your site?
Scan any URL free to check X-Content-Type-Options and every other security header.
Scan Now - Free