Turning off MIME sniffing: Crawl Audit check 148

Short answer: browsers sometimes guess what a file is from its contents, called MIME sniffing. The nosniff header tells them to trust the Content-Type your server sends instead, so a file served as text or an image isn't run as a script or stylesheet. Check 148 fails without it.

What Crawl Audit checks

• Pass: an X-Content-Type-Options header containing nosniff.
• Fail: no such header.

What MDN says

• The header "indicates that the MIME types advertised in the Content-Type headers should be respected and not changed."
• It "Blocks a request if the request destination is of type style and the MIME type is not text/css, or of type script and the MIME type is not a JavaScript MIME type."
• "Site security testers usually expect this header to be set (and that the Content-Type header is correctly set for all resources)."

Adding it

It's one line, and the value never changes:

X-Content-Type-Options: nosniff

• nginx: add_header X-Content-Type-Options "nosniff" always;
• Apache: Header always set X-Content-Type-Options "nosniff"

Before you add it, make sure your server sends the right Content-Type for JavaScript and CSS files. If a script is served as text/plain, nosniff will block it and that part of the site will stop working. Reload a few pages with the developer console open afterwards.

On devmarde.com

We didn't send this header until 6 October, so the check failed for us. We added it to every page that day and it passes now.

Sources

• MDN, X-Content-Type-Options (updated 17 March 2026), checked 6 October 2026.