Missing X-Content-Type-Options header: add nosniff the right way

Updated Oct 27, 2026 · Pewterkit Guides

The fix for "Missing X-Content-Type-Options" is one response header on every page and file: X-Content-Type-Options: nosniff. It tells browsers to use the Content-Type your server sends instead of guessing from the file's contents. Check that your scripts are served as JavaScript and your stylesheets as text/css first, because with nosniff a wrong type gets blocked.

What nosniff does

MDN: the header "indicates that the MIME types advertised in the Content-Type headers should be respected and not changed." It has two effects:

  • Scripts and stylesheets are checked. The browser "blocks the response if the MIME type doesn't match an expected type (a JavaScript MIME type for scripts, or text/css for stylesheets)."
  • No guessing for everything else. MDN's example: a response sent as text/plain with nosniff will not be treated as HTML "even if the content contains HTML markup."

The second point is what protects you: it stops a file that a user uploaded (a profile picture, a text attachment) from being run as a web page on your domain.

Add the header

Netlify or Cloudflare Pages (_headers file):

/*
  X-Content-Type-Options: nosniff

Vercel (vercel.json; this is Vercel's own example header):

{
  "headers": [
    {
      "source": "/(.*)",
      "headers": [{ "key": "X-Content-Type-Options", "value": "nosniff" }]
    }
  ]
}

Test this on a preview deployment before relying on it.

Check your content types first

After adding the header, open your site with developer tools open:

  1. In the Console, look for messages that a script or stylesheet was refused because of its MIME type.
  2. In Network, click your main .js and .css files and read content-type in the response headers. Scripts should be text/javascript (or another JavaScript type), stylesheets text/css.

If those types are right, nosniff changes nothing for your own files. Pay most attention to files your own server code, a storage bucket or a proxy sends, since those set their own type.

What Pewterkit Check looks at

The check reads your home page's response headers and looks for X-Content-Type-Options containing nosniff. A missing value is reported together with the other basic browser protections (HSTS, clickjacking protection, a referrer policy) in one finding. It skips builder subdomains, where the platform controls the headers.

FAQ

Is nosniff still needed in modern browsers?

Yes. It's a one-line header, MDN describes current browser behavior with it, and site security testers "usually expect this header to be set", per MDN.

Can nosniff break my site?

Only where a script or stylesheet is served with the wrong Content-Type. Fix the type and the file loads again.

Do I add it to every file or only HTML pages?

Every response. The /* and /(.*) patterns above cover all paths.

Sources

  1. X-Content-Type-Options header (MDN) — read 27 Oct 2026
  2. Static configuration with vercel.json: headers (Vercel Docs) — read 27 Oct 2026
  3. Custom headers (Netlify Docs) — read 27 Oct 2026
  4. Headers (Cloudflare Pages docs) — read 27 Oct 2026

How this page was made: drafted with AI from the sources listed, reviewed by Pewterkit. Docs checked Oct 27, 2026. Spotted something out of date? Tell us.

Related guides