X-Content-Type-Options

Prevents browsers from guessing a different MIME type than the one declared by the server.

Set this header to `nosniff` so browsers respect declared content types and do not interpret resources as executable content unexpectedly.

securityheadermimenosniff

Header (http)

X-Content-Type-Options: nosniff

The header has one useful value: nosniff. It is especially important for scripts and styles, where MIME confusion can create security issues.

Common mistakes

Serving JavaScript or CSS with an incorrect Content-Type and trying to fix it with this header.
Treating nosniff as a replacement for a correct CSP.

IANA registry: http-fields/field-names

Registry reference: Fetch

Sources