X-Content-Type-Options
Prevents MIME-type sniffing. nosniff tells browser to respect declared Content-Type.
ResponseSyntax
X-Content-Type-Options: nosniffExample values
| Value | Explanation |
|---|---|
| nosniff | Only valid value |
cURL usage
curl -I https://example.com # Check security headers
Common mistakes
Not setting; allows XSS via MIME confusion.