Home / Fix guides / X-Content-Type-Options

Add X-Content-Type-Options: nosniff

Low

Without X-Content-Type-Options: nosniff, browsers may 'sniff' a file and treat, say, an uploaded text file as a script.

Why it matters

Matters most if users can upload files that you serve back from your own domain.

Quick fix

Add X-Content-Type-Options: nosniff to every response.

Step by step

Add the header

# public/_headers (Netlify and Cloudflare Pages)
/*
  Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
  X-Frame-Options: DENY
  X-Content-Type-Options: nosniff
  Referrer-Policy: strict-origin-when-cross-origin
  Permissions-Policy: camera=(), microphone=(), geolocation=()

Prompt for your AI builder

Paste this into Lovable, Bolt, v0, Cursor or Replit, then review the changes before deploying.

Add the header X-Content-Type-Options: nosniff to every response of my app.

References

MDN: X-Content-Type-Options

Check your app

Run a free scan