When convenient

A small browser safety switch is off

What it means

Every file your site sends comes with a label that says what it is: a web page, an image, a script, a style sheet. The label is called the content type.

Some browsers used to second-guess that label. If a file labeled as an image looked a bit like a script, the browser might treat it as a script. This guessing is called MIME sniffing.

The header X-Content-Type-Options: nosniff tells the browser to stop guessing and trust the label. It has only one valid value, nosniff, so there is nothing to tune.

Why it matters

Guessing has been used to slip harmful scripts through files that look harmless, such as an uploaded picture or a text file. That matters most on sites that let visitors or staff upload files: contact forms with attachments, job applications, or a shop with product photos added by several people.

With nosniff, browsers also refuse to run a script or apply a style sheet whose label is wrong. That closes the trick off at the source.

EverThread rates this as a fix to make when convenient. It is a small safety switch, not a sign that anything is wrong today.

How to check your own site

1. Open your home page in Chrome, Edge or Firefox. Right-click the page, choose Inspect, and open the Network tab.
2. Reload the page. Click the first row in the list, which is the page itself, and look at the Response Headers section.
3. Look for x-content-type-options: nosniff. If it is not there, the header is missing.

How to fix it

Any website

1. Add the response header X-Content-Type-Options: nosniff to every page and file your site sends.
2. After adding it, open your site with the browser's developer tools open on the Console tab. Click through a few pages. If a script or style sheet was mislabeled, you will see a message saying it was blocked because of its MIME type. Your developer can fix the label on the server.

WordPress

1. Headers are usually best set at the server or CDN, not inside WordPress, so they cover images and uploads too. Those are the files this header protects most.
2. Check your host's dashboard for a security headers setting. Names vary by host.
3. If your host runs Apache, add the lines from the Apache section below to the .htaccess file in your site's main folder.
4. A plugin is the fallback. Search the plugin directory for "security headers" and pick one that is actively maintained.

Shopify, Squarespace, Wix and other hosted builders

1. These platforms run the servers, so you usually cannot add custom headers. Many already send nosniff for you.
2. If EverThread reports it missing on a hosted site, there is usually no setting to change. You can ask the platform's support about it, but you do not need to move platforms over this header.

Cloudflare

1. Go to Rules and create a response header rule. Depending on your dashboard, this is under Transform Rules, then Modify Response Header, or under Rules, Overview, as a Response Header Transform Rule.
2. Apply it to all incoming requests. Choose Set static, enter X-Content-Type-Options as the header name and nosniff as the value, then deploy.
3. Cloudflare also offers a No-Sniff option inside its HSTS settings under SSL/TLS, Edge Certificates. Either works. Rules only apply to traffic that goes through Cloudflare, shown as an orange cloud in your DNS settings.

Apache (.htaccess)

1. Add these lines to the .htaccess file in your site's main folder, or to your server's site settings. This needs the mod_headers module, which most hosts have on.

<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
</IfModule>

Nginx

1. Add this line inside your site's server block, then reload Nginx.

add_header X-Content-Type-Options "nosniff" always;

What to send your developer

Send X-Content-Type-Options: nosniff on all responses, including static files and user uploads. Before rolling out, make sure scripts are served as text/javascript (or another JavaScript MIME type) and style sheets as text/css; with nosniff, browsers block scripts and styles with the wrong type. JSON endpoints should return application/json. In Nginx, an add_header in a location block stops server-level headers from being inherited, so check locations that set their own headers. If the header shows up twice, both the app and the server are setting it; remove one. See MDN on X-Content-Type-Options.

X-Content-Type-Options: nosniff

Common questions