Security Tools

X-Content-Type-Options Checker

Check whether a site tells browsers not to guess file types (nosniff).

Not sure what to enter? Try an example: github.com

Free & instant No signup How to use FAQ

Enter a URL to check for the X-Content-Type-Options: nosniff header.

What is X-Content-Type-Options: nosniff?

X-Content-Type-Options: nosniff tells browsers to trust the Content-Type the server declares instead of guessing ("sniffing") it from the content. This stops a file uploaded as, say, an image from being run as a script. It has a single valid value: nosniff.

How to check X-Content-Type-Options

Enter the domain in the box above.
Click Check X-Content-Type-Options.
Confirm the header is present with the value nosniff.
If it is missing, add it to every response in your server or CDN configuration.

Related checks

For all security headers at once, use the Security Headers Checker.
To confirm the Content-Type the server sends, use the HTTP Headers Checker.

X-Content-Type-Options: nosniff is a one-line fix with almost no risk of breaking anything - if it is missing, add it at your web server or CDN. JustChecker keeps an eye on it after every change to your hosting.

Frequently Asked Questions

Without it, browsers may guess that a file is a script or stylesheet even when it is served as something else - which attackers can abuse with uploaded files. nosniff makes browsers trust the declared type.

Only files served with the wrong Content-Type, such as JavaScript sent as text/plain. Fix the server's MIME types and the header is safe to enable everywhere.

Add "X-Content-Type-Options: nosniff" in your server or CDN configuration; it is one of the header options in the .htaccess Generator.

Share this tool:

Need a website for your business? Only $599