Skip to main content
Security Auditor — checks that the X-Content-Type-Options response header is set to nosniff, so browsers trust the declared Content-Type instead of guessing it.

Protection

Stops browsers from running an uploaded file or a mislabeled response as a script or a stylesheet.

Standards

Follows the X-Content-Type-Options section of the WHATWG Fetch Standard.
When a response arrives with a missing or unexpected Content-Type, browsers may look at its bytes and guess what it is (“MIME sniffing”). An attacker who can upload a file that looks like HTML or JavaScript can use that guess to run code on your site. X-Content-Type-Options: nosniff turns the guessing off: scripts and stylesheets with the wrong type are blocked. This auditor reads that header from the audited URL.

​
How it works

  1. Fetch — sends a HEAD request (or GET when HEAD is not supported) to the audited URL as 37AuditsBot. A blocked request ends the audit with 590; any other failure (timeout, DNS, TLS, non-2xx answer) ends it with 500.
  2. Read — collects every X-Content-Type-Options header line and joins them with commas, as browsers do.
  3. First value — like browsers, looks only at the first comma-separated value and compares it with nosniff ignoring letter case. nosniff, nosniff passes; none, nosniff fails.
  4. Rules — a missing or empty header (400) and a first value other than nosniff (401) fail.
  5. Aggregate — when every rule passes the audit is SUCCESS (200).
  6. Specification pin — every run emits 37A-XContentTypeOptionsAuditor-100 (INFORMATION), naming the X-Content-Type-Options section of the WHATWG Fetch Living Standard as of 2026-10-15. It does not change the overall status.

​
What it audits

Every row maps to one checkRule* method and one CheckCode, in the order the auditor runs them. CheckCode suffixes use status ranges: 100 information, 200 success, 300–399 warning, 400–499 fail, 500–599 error.

​
Output documentation

​
Risks and considerations

​
Why MIME sniffing is dangerous

  • Sites that serve user uploads (avatars, attachments, documents) are the classic target: a file uploaded as an image but containing HTML or JavaScript can be run by a browser that sniffs it, giving the attacker cross-site scripting on your domain.
  • With nosniff, browsers block scripts and stylesheets whose Content-Type is not a script or CSS type, and Chrome’s cross-origin read blocking protects more responses.

​
Only nosniff counts

  • The header has one valid value. Browsers read the first comma-separated value only, so a typo such as no-sniff or a stray value placed first leaves the protection off without any error.

​
Setting it safely

  • Add the header to every response (pages, APIs and static files), usually once in the web server, CDN or framework configuration.
  • Make sure each response sends a correct Content-Type: with nosniff, a script served as text/plain stops loading.

​
What this auditor does not check

  • Only the audited URL is fetched; uploads, static assets and API responses may be served without the header.
  • The Content-Type of the response is not checked.