---
title: "Stop browsers guessing file types · Agent Wranglers"
url: https://agentwranglers.se/playbook/website/security/x-content-type-options
updated: 2026-10-20
licence: "All rights reserved"
---

# Stop browsers guessing file types

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Security](https://agentwranglers.se/playbook/website/security)
- Rule: Send `X-Content-Type-Options: nosniff` on every response, so browsers don't guess file types. Give every response its correct Content-Type.
- How: Add the header in middleware that runs for every response. Map every file extension to its correct type.
- Check: `curl -sI` on HTML, CSS, JS, JSON and images shows `nosniff` and the right type.

Example:

```http
HTTP/2 200
content-type: text/css; charset=utf-8
x-content-type-options: nosniff
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers website playbook: https://agentwranglers.se/playbook/website/security/x-content-type-options`.

- Previous: [Tell people how to report a hole](https://agentwranglers.se/playbook/website/security/security-txt)
- Next: [Refuse to be framed](https://agentwranglers.se/playbook/website/security/frame-ancestors)
- [Security](https://agentwranglers.se/playbook/website/security)