The X-Content-Type-Options response HTTP header is a marker used by the server to indicate that the MIME types advertised in the Content-Type headers should not be changed and be followed. This allows to opt-out of MIME type sniffing, or, in other words, it is a way to say that the webmasters knew what they were doing.

This header was introduced by Microsoft in IE 8 as a way for webmasters to block content sniffing that was happening and could transform non-executable MIME types into executable MIME types. Since then, other browsers have introduced it, even if their MIME sniffing algorithms were less aggressive.

Site security testers usually expect this header to be set.

Note: nosniff only applies to "script" and "style" types. Also applying nosniff to images turned out to be incompatible with existing web sites.


X-Content-Type-Options: nosniff


Blocks a request if the requested type is
  • "style" and the MIME type is not "text/css", or
  • "script" and the MIME type is not a JavaScript MIME type.


Specification Status Comment
The definition of 'X-Content-Type-Options definition' in that specification.
Living Standard Initial definition

Browser compatibility

Feature Chrome Firefox Edge Internet Explorer Opera Safari
Basic Support 1.0 50 (Yes) 8.0 13 (No)
Feature Android Chrome for Android Edge mobile Firefox for Android IE mobile Opera Android iOS Safari
Basic Support (Yes) (Yes) (Yes) 50 (Yes) (Yes) (No)

See also

© 2005–2017 Mozilla Developer Network and individual contributors.
Licensed under the Creative Commons Attribution-ShareAlike License v2.5 or later.