X-Content-Type-Options header

The HTTP X-Content-Type-Options response header indicates that the MIME types advertised in the Content-Type headers should be respected and not changed. The header allows you to avoid MIME type sniffing by specifying that the MIME types are deliberately configured.

Site security testers usually expect this header to be set.

Note: The X-Content-Type-Options header only apply request-blocking due to nosniff for request destinations of "script" and "style".

Header type	Response header
Forbidden request header	No

Syntax

http

X-Content-Type-Options: nosniff

Directives

nosniff: Blocks a request if the request destination is of type style and the MIME type is not text/css, or of type script and the MIME type is not a JavaScript MIME type.