Security Required

Stop browsers guessing file types

Send X-Content-Type-Options: nosniff on every response, so browsers don't guess file types. Give every response its correct Content-Type.

By Erik Bergstedt, Agent Wranglers. Updated 20 October 2026.

How to do it

Add the header in middleware that runs for every response. Map every file extension to its correct type.

Example

HTTP/2 200
content-type: text/css; charset=utf-8
x-content-type-options: nosniff

How to check

curl -sI on HTML, CSS, JS, JSON and images shows nosniff and the right type.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers website playbook: https://agentwranglers.se/playbook/website/security/x-content-type-options.