The X-Content-Type-Options response HTTP header is a marker used by the server to indicate that the MIME types advertised in the Content-Type headers should not be changed and be followed. This allows to opt-out of MIME type sniffing, or, in other words, it is a way to say that the webmasters knew what they were doing.

This header was introduced by Microsoft in IE 8 as a way for webmasters to block content sniffing that was happening and could transform non-executable MIME types into executable MIME types. Since then, other browsers have introduced it, even if their MIME sniffing algorithms were less aggressive.

Site security testers usually expect this header to be set.

Note: nosniff only applies to "script" and "style" types. Also applying nosniff to images turned out to be incompatible with existing web sites.

Header type Response header
Forbidden header name no

Syntax

X-Content-Type-Options: nosniff

Directives

nosniff
Blocks a request if the requested type is
  • "style" and the MIME type is not "text/css", or
  • "script" and the MIME type is not a JavaScript MIME type.

Specifications

Specification Status Comment
Fetch
The definition of 'X-Content-Type-Options definition' in that specification.
Living Standard Initial definition

Browser compatibility

Update compatibility data on GitHub
DesktopMobile
ChromeEdgeFirefoxInternet ExplorerOperaSafariAndroid webviewChrome for AndroidEdge MobileFirefox for AndroidOpera for AndroidSafari on iOSSamsung Internet
Basic support
Non-standard
Chrome Full support 1Edge Full support YesFirefox Full support 50IE Full support 8Opera Full support YesSafari No support NoWebView Android Full support YesChrome Android Full support YesEdge Mobile Full support YesFirefox Android Full support 50Opera Android Full support YesSafari iOS No support NoSamsung Internet Android Full support Yes

Legend

Full support  
Full support
No support  
No support
Non-standard. Expect poor cross-browser support.
Non-standard. Expect poor cross-browser support.

See also

Document Tags and Contributors

Contributors to this page: rugk, Malvoz, ExE-Boss, DBaron, fscholz, WhatIsHeDoing, teoli
Last updated by: rugk,