Skip to main content
SlapMyWeb
Slap a site

Security fix

How to Add X-Content-Type-Options: nosniff

Stop browsers from MIME-sniffing responses: a one-line header that closes an XSS vector.

Difficulty
Easy
Impact
Medium
Time
2 min

Before

# No X-Content-Type-Options header

After

X-Content-Type-Options: nosniff
Before and after code for: How to Add X-Content-Type-Options: nosniff

A missing X-Content-Type-Options header lets browsers guess a file's type from its contents rather than trusting the declared Content-Type. That guessing can turn an uploaded file into executable script. Send X-Content-Type-Options: nosniff on every response: it is a single header with no side effects for correctly typed files.

How common is this?

Across every site SlapMyWeb has audited, 51.6% send X-Content-Type-Options, which leaves 48.4% with no nosniff header.

51.6%48.4%

Measured from SlapMyWeb audits of live public URLs. The full aggregate is published as a CC-BY-4.0 dataset.

Why it matters

Without this header, browsers may "sniff" a response's content type and execute, say, an uploaded image as a script. nosniff forces the browser to honour the declared Content-Type, closing that vector.

How to fix it

  1. Send the header site-wide

    Add X-Content-Type-Options: nosniff to every response.

  2. Set correct content types

    Make sure your server sends accurate Content-Type headers so nosniff doesn't break legitimate files.

The code

Beforehttp
# No X-Content-Type-Options header
Afterhttp
X-Content-Type-Options: nosniff

On your platform

WordPress

Add via a security-headers plugin or .htaccess.

Next.js

Add it under headers() in next.config.js.

Sources

Check your site with our free tool

HTTP Header Checker

More fixes

Security

How to Add a Permissions-Policy Header

Restrict which browser features (camera, mic, geolocation) the page and its iframes can use.

Security

How to Secure Cookies (Secure, HttpOnly, SameSite)

Add the flags that stop cookies being stolen over HTTP, via XSS, or in CSRF attacks.

Security

How to Fix a Missing SSL Certificate

Serve the whole site over HTTPS so browsers stop marking it as not secure.

Fixed that one.
Now find the rest.

A free audit ranks every issue on your site by the score points it costs, and links each one straight to its guide.

Run a free audit
Free foreverNo signupLive scan progress