X-Content-Type-Options

Stops browsers from guessing content types.

Listen

A podcast overview of X-Content-Type-Options made with Google NotebookLM.

All government websites must have X-Content-Type-Options designated.

X-Content-Type-Options is a security header that:

Prevents browsers from MIME-sniffing.
Ensures content is rendered as declared (e.g., no misinterpretation of file types).
Stops browsers from guessing content types, enhancing security.

Example header:

X-Content-Type-Options: nosniff

Example HTML code:

<!-- Example of setting X-Content-Type-Options in a meta tag -->
<meta http-equiv="X-Content-Type-Options" content="nosniff">

On this page