How to add the X-Content-Type-Options header in Next.js

This header stops browsers from guessing (sniffing) a file's type and makes them respect the Content-Type you send.

Next.js configuration (next.config)

async headers() {
  return [
    {
      source: "/:path*",
      headers: [{ key: "X-Content-Type-Options", value: "nosniff" }],
    },
  ];
}

Add the headers() function to your Next.js config and restart or redeploy. Headers set by a proxy or CDN in front can override these.

Make sure your server sends correct Content-Type headers, or some files may stop loading.

curl -sI https://your-site.com | grep -i x-content-type-options

Or run a free Korrali Web scan to check this and every other security header at once.