KKorrali Web

Security headers › X-Content-Type-Options

How to add the X-Content-Type-Options header in Vercel

This header stops browsers from guessing (sniffing) a file's type and makes them respect the Content-Type you send.

Vercel configuration (vercel.json)

{
  "headers": [
    {
      "source": "/(.*)",
      "headers": [
        {
          "key": "X-Content-Type-Options",
          "value": "nosniff"
        }
      ]
    }
  ]
}

Add to vercel.json at the project root and redeploy. Next.js projects on Vercel can set headers in next.config instead.

Before you deploy

Make sure your server sends correct Content-Type headers, or some files may stop loading.

Verify it works

curl -sI https://your-site.com | grep -i x-content-type-options

Or run a free Korrali Web scan to check this and every other security header at once.

Scan your site free

Other headers in Vercel