X-Content-Type-Options response HTTP header is a
marker used by the server to indicate that the MIME types advertised in the
Content-Type headers should be followed and not be changed. The header allows you to avoid MIME type sniffing by saying that the MIME types are deliberately
This header was introduced by Microsoft in IE 8 as a way for webmasters to block content sniffing that was happening and could transform non-executable MIME types into executable MIME types. Since then, other browsers have introduced it, even if their MIME sniffing algorithms were less aggressive.
Starting with Firefox 72, top-level
documents also avoid MIME sniffing (if
Content-type is provided). This can cause HTML web pages
to be downloaded instead of being rendered when they are served with a MIME type other
text/html. Make sure to set both headers correctly.
Site security testers usually expect this header to be set.
X-Content-Type-Options only apply
request-blocking due to
for request destinations of "
style". However, it also
enables Cross-Origin Read Blocking (CORB)
protection for HTML, TXT, JSON and XML files (excluding SVG
|Header type||Response header|
|Forbidden header name||no|
Blocks a request if the request destination is of type
styleand the MIME type is not
text/css, or of type
|Fetch Standard |
BCD tables only load in the browser
Browser specific notes
Firefox 72 enables
X-Content-Type-Options: nosnifffor top-level documents
- The original definition of X-Content-Type-Options by Microsoft.
- The Mozilla Observatory tool testing the configuration (including this header) of Web sites for safety and security
- Mitigating MIME Confusion Attacks in Firefox
- Cross-Origin Read Blocking (CORB)
- Google Docs CORB explainer