Skip to content
DomainGrade

What we checkSecurity headersHD-02

X-Content-Type-Options

nosniff stops browsers guessing a file's type instead of believing the one you sent.

Area
Security headers
Check
HD-02
Included
Free in every scan

What we check

We check for X-Content-Type-Options: nosniff on your homepage.

Why it matters

Without it, a browser that thinks your JSON or your uploaded image looks like a script may execute it as one — which turns a file upload into a way to run code on your domain.

It is one header, one value, and no compatibility risk.

The specific case worth picturing is a file upload. A user-supplied file served with a benign content type but containing markup can be treated as HTML by a sniffing browser — and that HTML runs on your origin, with your cookies in scope.

How to fix it

  1. 1

    Send the header on every response.

  2. 2

    Check your file-serving paths in particular: uploads, exports and generated documents are where a sniffed content type does the most damage.

  3. 3

    Check your file-serving paths in particular: uploads, exports and generated documents are where a sniffed content type does the most damage.

  4. 4

    If enabling it breaks something you have found a response whose declared type is wrong — fix the type rather than removing the header.

A response header
X-Content-Type-Options: nosniff

Common questions

Is there any downside?
Only if you rely on the browser correcting a Content-Type you send wrongly — in which case the header is telling you about a real bug.
Does it need to be on every response?
Yes, especially on user-uploaded files, which is where it matters most.
Are there other values?
No. nosniff is the only one.

See how your domain does on this check.

All 34 checks, a grade, and the exact fix for anything that isn’t right — in about twenty seconds, no signup.

Other security headers checks