X-Content-Type-Options: the one-line header against MIME sniffing
The rare genuine one-liner
Most security advice comes with caveats, rollout plans and trade-offs. This one mostly does not. X-Content-Type-Options: nosniff is a single header with a single value, it is safe to add to almost any site, and it closes a real if narrow gap. If you are looking for the easiest item on a header checklist, start here.
What MIME sniffing is
Every file a server sends comes with a declared type — its MIME type — in the Content-Type header: text/html, image/png, application/javascript, and so on. The browser is supposed to treat the file as whatever that header says.
Historically, browsers did not fully trust that header. If the declared type looked wrong, or was missing, they would inspect the actual bytes and make their own guess about what the file really was. That guessing is called MIME sniffing, and it existed to paper over misconfigured servers.
Why guessing is a problem
The trouble is when the browser guesses up in privilege. Picture a site that lets users upload files. An attacker uploads something that is served as a harmless type — an image, a text file — but whose contents are actually JavaScript. If the browser sniffs the bytes, decides it looks like a script, and runs it, you have just executed attacker code from your own domain. The declared type said 'image'; the sniffing said 'script'; the script won.
This is most relevant for sites that serve user-uploaded or user-generated content, but it is cheap insurance everywhere.
What nosniff does
The header is exactly this:
X-Content-Type-Options: nosniff
With it set, the browser stops guessing and honours the declared Content-Type you sent. A file labelled as an image is treated as an image, full stop. If it is not actually an image, it does not get upgraded into something executable.
For this to fully help, your server should also send correct content types — nosniff makes the browser trust your labels, so the labels need to be right.
Why it is so often missing
Nothing sets it for you. Frameworks and hosts usually leave it off unless someone deliberately adds it, so it is absent on a large share of sites — including plenty that are otherwise well built. There is no framework or builder to blame; it is simply a header nobody mentioned. Adding it is typically one line in your server config, reverse proxy, or a middleware in your app.
Where it sits among headers
nosniff is part of the standard set worth having: alongside it, add X-Frame-Options against clickjacking, Strict-Transport-Security to enforce HTTPS, Referrer-Policy, and eventually a Content-Security-Policy. Individually each is a small win; together they meaningfully shrink your attack surface for very little effort.
Check your headers
You cannot see which headers your site sends just by viewing it — they are invisible to the page. An automated scan reads your actual responses and reports whether nosniff and the rest are present, missing or weak. Scan your site and see your header gaps.