# X-Content-Type-Options 1. [Home](https://mysites.guru/) 2. [Tools](https://mysites.guru/tools/) 3. [Security headers](https://mysites.guru/tools/security-headers/) 4. X-Content-Type-Options # X-Content-Type-Options ![X-Content-Type-Options](https://mysites.guru/_astro/x-content-type-options.BQzPs9p9_ehH5Q.webp) X-Content-Type-Options: nosniff stops browsers guessing a file's type, closing a route for smuggling scripts past uploads. The Apache and nginx lines to add. ## Quick answer Send X-Content-Type-Options: nosniff on every response, so browsers use the declared Content-Type instead of guessing and an uploaded file can't run as a script. On Apache add this to .htaccess; on nginx use add\_header X-Content-Type-Options "nosniff" always; ```apache Header always set X-Content-Type-Options "nosniff" ``` Article Contents - [How the X-Content-Type-Options check works](#how-the-x-content-type-options-check-works) - [How a browser’s guesswork turns into script execution](#how-a-browsers-guesswork-turns-into-script-execution) - [One value, and nothing weighed against it](#one-value-and-nothing-weighed-against-it) - [How to add the nosniff header](#how-to-add-the-nosniff-header) - [Why we leave server headers alone](#why-we-leave-server-headers-alone) - [Further Reading](#further-reading) - [Frequently Asked Questions](#faq) How common is this? - 31.4% of the Joomla sites we have this data for fail this check. Platform: Joomla. Measured across the sites we audit, on each site's most recent snapshot. ## How the X-Content-Type-Options check works mySites.guru requests a page from your Joomla extension site and reads back the HTTP response headers to check whether `X-Content-Type-Options` is present and set to `nosniff`, its only valid value. We check this against a page your server answers directly, such as a 404, rather than only the homepage, so the result reflects the whole site rather than just whatever a Joomla extension can add to a PHP response. It’s one of the header checks walked through in [checking your website’s security headers with mySites.guru](https://mysites.guru/blog/check-your-websites-security-headers-with-mysites-guru/). ## How a browser’s guesswork turns into script execution Every response your server sends has a `Content-Type` header declaring what kind of file it is: `text/html`, `image/jpeg`, `application/javascript`, and so on. Browsers are supposed to trust that declaration, but historically they didn’t always. Older versions of Internet Explorer and Chrome would look past the declared type and inspect the actual bytes of a file to guess what it “really” was, a behaviour called MIME sniffing, and would sometimes act on that guess instead of the header. That becomes a real problem the moment a site accepts any kind of upload. Imagine a file uploaded with an image extension and an `image/jpeg` Content-Type, but whose actual content is a script. A browser that trusts the declared type renders it as a broken image and moves on. A browser that sniffs the content can decide it’s actually HTML or JavaScript and execute it, which is exactly the kind of gap that turns an innocuous file upload feature into a cross-site scripting vector. `nosniff` closes that gap by telling the browser, unambiguously, to stop guessing and use the declared type. There’s a second, related risk worth knowing about even though `nosniff` doesn’t fully solve it on its own: reflected file download attacks, where an attacker crafts a URL that returns attacker-controlled content with a filename and content type engineered to make the browser offer it as a download, disguised as something trustworthy, like a PDF invoice that’s actually a batch script. `nosniff` narrows the gap by stopping the browser reinterpreting the content type on its own initiative, though the server still needs to set a correct `Content-Type` and, ideally, a `Content-Disposition` header in the first place for downloads it serves on purpose. ## One value, and nothing weighed against it There’s only one value worth sending, and only one decision to make: ```text X-Content-Type-Options: nosniff ``` There’s no trade-off to weigh here the way there is with Content-Security-Policy or HSTS. `nosniff` has no legitimate downside for any normal site, costs nothing to add, and every response should carry it. Since Joomla 3.9.3, this header has shipped in Joomla’s own distributed `.htaccess` and `web.config` files, so a site that’s never had its server config touched since installing usually already has it. It’s the sites where that default `.htaccess` has been replaced or heavily customised where this check tends to fail. In practice, that’s a more common situation than it sounds. A site moved between hosts, a caching plugin that rewrites `.htaccess` as part of its own setup, a hosting control panel that regenerates the file from its own template, or simply a developer who replaced the whole file years ago and never thought to check what Joomla’s original version contained, can all drop this header along with whatever else Joomla shipped by default. None of those situations look like a mistake from the inside. The site works, nothing throws an error, and the missing header sits unnoticed until something checks for it specifically. ## How to add the nosniff header Set the header at server level so every response has it, static files included, not just the ones Joomla itself renders. In an `.htaccess` file, for `https://yoursite.com/administrator` and your front end alike: ```apache Header always set X-Content-Type-Options "nosniff" ``` On nginx, inside your server block: ```nginx add_header X-Content-Type-Options "nosniff" always; ``` 1. Check your current `.htaccess` (or nginx config) for an existing `X-Content-Type-Options` line. If your server config has been rebuilt or replaced since installing Joomla, it may have been dropped along with the rest of Joomla’s shipped defaults. 2. Add the directive above at server or virtual host level. 3. Confirm it’s present with a quick header check: `curl -sI https://yoursite.com/` and look for `x-content-type-options: nosniff` in the response. 4. Check a non-PHP path too, such as an image or CSS file directly, not just the homepage. A header added through a Joomla extension only appears on responses PHP actually handles, so a server-level fix should show up everywhere while a plugin-only one won’t. 5. There’s no follow-up testing needed beyond that. Unlike Content-Security-Policy or Strict-Transport-Security, this header has no failure mode that breaks legitimate functionality, so once it’s confirmed present, the job is done. ## Why we leave server headers alone Setting this header means editing server or virtual host config, which sits outside what a Joomla extension can reach, so we don’t apply it for you. mySites.guru checks for `X-Content-Type-Options: nosniff` on every snapshot, twice a day, and flags it clearly when it’s missing, alongside the other response headers we check: [Content-Security-Policy](https://mysites.guru/tools/security-headers/content-security-policy/), [Strict-Transport-Security](https://mysites.guru/tools/security-headers/strict-transport-security/) and [X-Frame-Options](https://mysites.guru/tools/security-headers/x-frame-options/). ## [X-Content-Type-Options](https://mysites.guru/free-audit/?check=joomla/responsesecurityheadersinformation/xcontenttypeoptions) mySites.guru checks every connected site for this automatically and flags it the moment it appears. These run twice a day on every connected site. [Check your site for free](https://mysites.guru/free-audit/?check=joomla/responsesecurityheadersinformation/xcontenttypeoptions) ## Further Reading - [Scott Helme: hardening your HTTP response headers (X-Content-Type-Options)](https://scotthelme.co.uk/hardening-your-http-response-headers/#x-content-type-options) - [KeyCDN: What is X-Content-Type-Options?](https://www.keycdn.com/support/x-content-type-options) - [KeyCDN: What is MIME sniffing?](https://www.keycdn.com/support/what-is-mime-sniffing) KeyCDN's support articles go into more depth on MIME sniffing than we have room for here. ## Frequently Asked Questions Show all What does the X-Content-Type-Options header actually do? It has exactly one valid value, nosniff, and it tells the browser to trust the Content-Type your server declared for a response instead of inspecting the file's actual bytes and guessing. Without it, a browser can decide a file is a different type than the one your server said it was. What is MIME sniffing and why is it a problem? MIME sniffing is a browser looking at a file's content, not its declared Content-Type, to decide how to handle it. It becomes a security problem the moment a site accepts uploads: a file given an image extension and an image content type can still have script content inside it, and a browser that sniffs rather than trusts the header can end up executing it. Does setting this one header make my site secure? No, and nothing claims it does. It closes one specific route, MIME-type confusion around uploaded or served content, and costs nothing to add since nosniff has no legitimate downside. It's one of several headers worth setting, not a substitute for the rest. [![EU icon: AI MODIFIED](https://mysites.guru/_astro/ai-modified.CaoawZEQ_1In0VX.webp)Written and edited by a human, with AI assistance. Our approach to AI](https://mysites.guru/ai-statement/) ### Article Contents - [How the X-Content-Type-Options check works](#how-the-x-content-type-options-check-works) - [How a browser’s guesswork turns into script execution](#how-a-browsers-guesswork-turns-into-script-execution) - [One value, and nothing weighed against it](#one-value-and-nothing-weighed-against-it) - [How to add the nosniff header](#how-to-add-the-nosniff-header) - [Why we leave server headers alone](#why-we-leave-server-headers-alone) - [Further Reading](#further-reading) - [Frequently Asked Questions](#faq) - **Published** - 28 August 2026 - **Applies to** - Joomla - **One-click fix** - Manual fix Share [](https://x.com/intent/post?url=https%3A%2F%2Fmysites.guru%2Ftools%2Fsecurity-headers%2Fx-content-type-options%2F&text=X-Content-Type-Options)[](https://bsky.app/intent/compose?text=X-Content-Type-Options%20https%3A%2F%2Fmysites.guru%2Ftools%2Fsecurity-headers%2Fx-content-type-options%2F)[](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fmysites.guru%2Ftools%2Fsecurity-headers%2Fx-content-type-options%2F) Topics [Security headers](https://mysites.guru/tools/security-headers/)Joomla ★★★★★ > "mySites.guru is a great tool for keeping [Joomla! websites](https://mysites.guru/manage-multiple-joomla-sites/) updated, [secure](https://mysites.guru/blog/security-audit-tools/), and under control. I use it regularly to [update extensions](https://mysites.guru/blog/automatic-updates-for-any-joomla-extension/), install packages, and [monitor my sites](https://mysites.guru/blog/uptime-monitoring-explained/). Phil's technical support is excellent: fast, knowledgeable, and genuinely helpful. Thanks Phil" ![Andrés Restrepo](https://mysites.guru/images/reviews/andres-restrepo.webp) Andrés RestrepoALAMARTE [](https://mysites.guru/reviews/) ## More checks in [Security headers](https://mysites.guru/tools/security-headers/) - [ ### Content-Security-Policy Content-Security-Policy is a response header that tells the browser which sources of scripts and content it may load, closing off most XSS attacks. ](https://mysites.guru/tools/security-headers/content-security-policy/) - [ ### Strict-Transport-Security (HSTS) Strict-Transport-Security (HSTS) makes browsers use HTTPS only for your site. The max-age to set, includeSubDomains, and the Apache and nginx lines to add. ](https://mysites.guru/tools/security-headers/strict-transport-security/) - [ ### X-Frame-Options X-Frame-Options stops other sites loading your pages in an iframe, which blocks clickjacking. The SAMEORIGIN value and the Apache and nginx lines to add. ](https://mysites.guru/tools/security-headers/x-frame-options/) ## More from the blog [ ![Check your site's security headers](https://mysites.guru/_astro/mySites.guru-REFRESH-BLACK-13-1024x538.TbklMHsm_1rleEI.webp) ### Check your site's security headers mySites.guru checks eight HTTP security headers on every snapshot - CSP, HSTS, X-Frame-Options and more - to help you harden against XSS and clickjacking. ](https://mysites.guru/blog/check-your-websites-security-headers-with-mysites-guru/) ## See where your own sites stand One free audit of one site · no card · about 2 minutes to connect [Get Your Free Site Audit](https://manage.mysites.guru/en/register) [How the X-Content-Type-Options check works](#how-the-x-content-type-options-check-works) [How a browser’s guesswork turns into script execution](#how-a-browsers-guesswork-turns-into-script-execution) [One value, and nothing weighed against it](#one-value-and-nothing-weighed-against-it) [How to add the nosniff header](#how-to-add-the-nosniff-header) [Why we leave server headers alone](#why-we-leave-server-headers-alone) [Further Reading](#further-reading) [Frequently Asked Questions](#faq)