KKorrali Web

Security headers › X-Content-Type-Options

How to add the X-Content-Type-Options header in Cloudflare

This header stops browsers from guessing (sniffing) a file's type and makes them respect the Content-Type you send.

Cloudflare configuration (Transform Rules)

Rules > Transform Rules > Modify Response Header
Action: Set static
Header name: X-Content-Type-Options
Value: nosniff

Create the rule for your hostname in the Cloudflare dashboard. For HSTS, Cloudflare also has a dedicated setting under SSL/TLS > Edge Certificates. On Cloudflare Pages you can use a _headers file instead.

Before you deploy

Make sure your server sends correct Content-Type headers, or some files may stop loading.

Verify it works

curl -sI https://your-site.com | grep -i x-content-type-options

Or run a free Korrali Web scan to check this and every other security header at once.

Scan your site free

Other headers in Cloudflare