# X-Content-Type-Options

> X-Content-Type-Options: nosniff is an HTTP header that stops browsers from guessing a file's type, so a file cannot run as something it was not sent as.

- **Check ID:** SEC5
- **Area:** [Security](https://be1st.ai/glossary/security)
- **Tool:** [SEO + Security + Performance](https://be1st.ai/tools/ssp-audit)
- **Page:** https://be1st.ai/glossary/security/x-content-type-options

## Why it matters

Without the nosniff header, a browser may interpret an uploaded text file as JavaScript and execute it. An attacker can thus upload malicious code disguised as an image or text file, which the browser will execute instead of displaying.

## In practice

Dropbox.com sends X-Content-Type-Options: nosniff with all responses. If someone uploads a file evil.jpg containing JavaScript code, the browser will strictly treat it as an image thanks to nosniff and will not execute the script.

## How be1st checks it

Checks for the presence of the X-Content-Type-Options HTTP header with the value nosniff. This header prevents the browser from MIME type sniffing: automatically guessing the content type, which can lead to interpreting a harmless file as an executable script.

[SEO + Security + Performance](https://be1st.ai/tools/ssp-audit), Security tab.

Every check ends as: Pass, Warning, Fail.

## Sources

- [X-Content-Type-Options header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Content-Type-Options) (MDN)
- [OWASP Secure Headers Project](https://owasp.org/projects/secure-headers-project) (OWASP)

## Related terms

- [Referrer-Policy](https://be1st.ai/glossary/security/referrer-policy): Referrer-Policy is an HTTP header that controls how much of the current URL the browser sends to other sites when a visitor follows a link or a resource loads.
- [Permissions-Policy](https://be1st.ai/glossary/security/permissions-policy): Permissions-Policy is an HTTP header that turns browser features such as the camera, microphone or geolocation on or off for a page and its frames.
- [Mixed content](https://be1st.ai/glossary/security/mixed-content): Mixed content means resources, such as images or scripts, that an HTTPS page loads over unencrypted HTTP. Browsers block or flag them.
- [Security warnings](https://be1st.ai/glossary/security/security-warnings): Security warnings are messages the browser writes to its console when it finds a security problem on a page, such as a blocked resource or an invalid policy.
- [Insecure cookies](https://be1st.ai/glossary/security/insecure-cookies): An insecure cookie is a cookie set without the Secure, HttpOnly or SameSite attribute, which leaves it open to theft or misuse by other sites.
- [Deprecated APIs](https://be1st.ai/glossary/security/deprecated-apis): Deprecated APIs are browser features that are being phased out. Code that still uses them can stop working once browsers remove them.