probeo

How to set X-Content-Type-Options?

x-content-type-options-missing global

The issue

Without X-Content-Type-Options: nosniff, a browser may decide for itself what a response is, so the type the server declared stops being a reliable boundary. A file served as plain text can be used as something else.

The cause is the header’s absence. With nosniff, browsers refuse to run a script or apply a stylesheet whose declared Content-Type doesn’t match.

Scope

Probeo checks each response it fetches for the header’s presence. It belongs on every response, including scripts, stylesheets, images and API responses. nosniff is the only defined value.

How to check you have it

  • In probeo: a response without the header is recorded as x-content-type-options-missing.
  • By hand: run curl -sI https://example.com/ and look for x-content-type-options: nosniff.

The fix

Add X-Content-Type-Options: nosniff to every response.

Set it at the web server or CDN so static files get it too. Check that each resource declares its real type, because with nosniff a script served as text/plain stops loading.

Done when: every response carries nosniff, and the check above comes back clean.

Do not

  • Do not leave out content types on the assumption that they are safe.
  • Do not use any value other than nosniff.
  • Do not use the header to paper over wrong Content-Type values.

FAQ

Does nosniff affect performance or caching?

No. The header affects only browser interpretation logic, not network behavior. Cache mechanisms continue operating normally. The header adds negligible overhead to response headers.

What happens when Content-Type is incorrect with nosniff active?

Browsers refuse to process the content. A JavaScript file served as text/html will not execute. This surfaces misconfigurations as errors rather than allowing silent reinterpretation. Correct operation requires accurate Content-Type declarations.

Can nosniff break existing functionality?

Only if the site relies on MIME sniffing to correct Content-Type errors. A stylesheet served as text/plain would previously load through sniffing. With nosniff, it fails. This failure indicates an existing misconfiguration that should be fixed at the source.

Does the header protect against all file upload attacks?

No. It prevents browsers from reinterpreting declared types. Other protections remain necessary: validating uploads, storing them outside web roots, serving them from separate domains, and setting correct Content-Type values. Nosniff is one control in a defense strategy.

Should nosniff be set for APIs that return JSON?

Yes. Declare Content-Type: application/json and include nosniff. Another page then can’t load the response as a script.

How does nosniff interact with content security policy?

They address different risks. CSP restricts which resources can load and execute. Nosniff ensures browsers interpret resources according to declared type. Both headers work together. CSP controls policy, nosniff enforces type interpretation.

Which product detects this

Probeo checks this on every page of your site as part of Site Clarity. This page explains one instance; the product tells you every page that has it.