What is X-Content-Type-Options? nosniff + free X-Content-Type-Options checker
X-Content-Type-Options is a response header that tells browsers to trust the Content-Type you sent—and not guess. Without nosniff, MIME sniffing can turn a “safe” download into HTML or script. A free X-Content-Type-Options checker (CrowWake’s security headers pulse) confirms nosniff is still live after CDN or origin changes.
What is X-Content-Type-Options?
X-Content-Type-Options is an HTTP response header. People search “what is X-Content-Type-Options,” “X-Content-Type-Options header,” or “nosniff” when a scanner, CDN checklist, or auditor flags MIME sniffing. It is not a DNS record and not a certificate—it is a header on the HTTPS response. The only useful value in practice is nosniff.
What MIME sniffing looks like without nosniff
Browsers historically “sniffed” bytes to decide whether a download was HTML, an image, or executable script—even when the server sent a different Content-Type. That MIME confusion is a classic XSS and drive-by path: upload a file the site serves as text/plain, and a sniffer still runs it as HTML. X-Content-Type-Options: nosniff tells supporting browsers to stick to the declared type.
How to check X-Content-Type-Options (free X-Content-Type-Options / security headers checker)
1) Run the free security headers checker on the hostname users hit (apex and www if both are live). 2) Confirm X-Content-Type-Options is present and note the value (expect nosniff). 3) If a scanner says “X-Content-Type-Options header missing,” publish nosniff at the CDN, load balancer, or web server. 4) After CDN, theme, or “simplify headers” deploys, re-check—nosniff wipes are common when someone trims header presets. 5) Pair with HSTS / X-Frame-Options / HTTPS redirect on the same checker so one pulse covers the security-header baseline.
What CrowWake checks
On HTTPS we look for an X-Content-Type-Options header. Missing → warn. Present → we summarize the value (almost always nosniff) so you notice accidental deletes after a CDN or origin change. The free security headers checker uses the same signal with no login. CrowWake is not a full MIME-type audit—this is the public nosniff pulse. For the repeat “watch headers hourly” job, see the dedicated security headers monitoring guide.
X-Content-Type-Options vs security headers monitoring
This guide is the definition and publish/triage job: what X-Content-Type-Options is, why nosniff matters, and how to check with a free X-Content-Type-Options / security headers checker. Security headers monitoring is the hourly rooster—catch a silent nosniff wipe alongside HSTS, framing, and HTTPS redirect. Both use the same free checker; CrowWake just repeats the pulse.
nosniff is the value that matters
Publish exactly: X-Content-Type-Options: nosniff. Other values are not useful in practice. Pair it with a correct Content-Type on each response—nosniff does not invent a type; it refuses to override the one you set. Static assets, APIs, and HTML pages all benefit when the edge or origin adds the header once.
How it fits with the other security headers
HSTS locks browsers onto HTTPS. X-Frame-Options (or CSP frame-ancestors) stops clickjacking. The HTTP→HTTPS redirect closes the cleartext door. X-Content-Type-Options closes MIME sniffing. CrowWake’s free X-Content-Type-Options / security headers checker reports all of these in one pass so a “simplify headers” deploy cannot silently drop nosniff while HSTS still looks fine.
Publish checklist
1) Run the free security headers checker and note the X-Content-Type-Options / nosniff row. 2) Add X-Content-Type-Options: nosniff at the CDN, load balancer, or web server (apex and www if both are live). 3) Confirm Content-Type on HTML and downloadable files still matches what you intend. 4) Re-check the live response with the free X-Content-Type-Options / security headers checker. 5) Add the domain so CrowWake crows if nosniff disappears after a rebuild.
If CrowWake crows
Missing X-Content-Type-Options → publish nosniff at the edge or origin. Present then gone → restore after a theme, panel, or “minify headers” change. Odd value instead of nosniff → replace with nosniff. After a fix, re-run the free security headers checker and keep watching. Deep dives: HSTS, X-Frame-Options, and HTTPS redirect use the same checker.
Watch this on CrowWake
Add the domain, leave the boxes checked, and the flock will crow when this drifts.
Or try the free X-Content-Type-Options / nosniff / security headers checker with no login.
Deep dive: Security headers monitoring — watch X-Content-Type-Options / nosniff with HSTS, framing, and HTTPS redirect on the same free X-Content-Type-Options / security headers checker.
Related: HSTS guide, X-Frame-Options / clickjacking, HTTPS redirect, the security headers & open ports guide, and the free security headers checker (same free checker covers all four).