Security Tools
X-Content-Type-Options Checker
Check whether a website sends an X-Content-Type-Options header to prevent MIME-sniffing.
Enter a domain to check whether it sends an X-Content-Type-Options header.
JustChecker monitors your security headers continuously and alerts you if any regress.
Frequently Asked Questions
Some browsers historically tried to guess a file's actual type by inspecting its content rather than trusting the declared Content-Type header - an attacker could exploit this by disguising executable script content as an "innocent" file type that gets sniffed and executed anyway.
It instructs the browser to strictly trust the declared Content-Type header and never attempt to guess a different type, closing off the MIME-sniffing attack vector entirely.
It's still relevant defense-in-depth for any static assets you serve, but it becomes especially important for sites that serve user-uploaded content, where an attacker has more control over what gets uploaded and potentially mis-typed.
It has exactly one valid value ("nosniff") and no configuration complexity - it's effectively an on/off switch, making it one of the easiest security headers to add with essentially no risk of breaking legitimate functionality.
Modern browsers have significantly reduced sniffing behavior compared to older versions, but explicitly setting this header remains a cheap, zero-downside best practice rather than relying on browser defaults alone.
No - it's one specific mitigation against one specific technique; proper upload validation, storage isolation, and content-type enforcement in your application remain necessary regardless.