X-Content-Type-Options
Stops browsers second-guessing the declared Content-Type of a response.
Recommended value
X-Content-Type-Options: nosniff
What it does
Browsers historically sniffed response bodies and overrode the declared type when it looked wrong. That behaviour turns a file upload into a script-execution vector: upload something that is declared text/plain but looks like HTML, and the browser may run it.
There is exactly one valid value, nosniff, and essentially no reason not to set it. It also makes browsers refuse to load stylesheets and scripts served with the wrong type, which occasionally surfaces a real bug on first deployment.
Sites sending this header
Found while scanning 188 well-known sites on 2026-08-04: