KKorrali Web

Security headers › X-Content-Type-Options

How to add the X-Content-Type-Options header in Nginx

This header stops browsers from guessing (sniffing) a file's type and makes them respect the Content-Type you send.

Nginx configuration (nginx server block)

add_header X-Content-Type-Options "nosniff" always;

Place it in the server or location block, then run nginx -t and reload. add_header in a location block replaces headers set at server level, so repeat them where needed. The always flag sends the header on error responses too.

Before you deploy

Make sure your server sends correct Content-Type headers, or some files may stop loading.

Verify it works

curl -sI https://your-site.com | grep -i x-content-type-options

Or run a free Korrali Web scan to check this and every other security header at once.

Scan your site free

Other headers in Nginx