X-Content-Type-Options

The site tells browsers not to guess the type of files it serves.

• • This page
  • LinkedIn
  • Bluesky
  • Mastodon
  • X
  • Email

Impact

ScanGov impact ratings

About

X-Content-Type-Options is a security header that:

• Prevents browsers from MIME-sniffing.
• Ensures content is rendered as declared (e.g., no misinterpretation of file types).
• Stops browsers from guessing content types, enhancing security.

Risks

Browsers might run dangerous files by mistake.

Why it's important

Stops browsers from guessing file types, helping prevent security risks by enforcing correct content handling.

Code

Example HTTP response header:

X-Content-Type-Options: nosniff

Error

ScanGov messaging when a site fails a standard:

Missing or wrong X-Content-Type-Options setting.

Guidance

• OWASP Top 10

Indicators

• Security