For the response you want to test, look for X-Content-Type-Options: nosniff and check that its Content-Type is correct. You can inspect one response in your browser’s Network panel or with a command-line HTTP client; a site-level scanner can check broader configuration. The result applies to the response you inspected, not automatically to every page or asset on the site.
What a MIME-sniffing test checks
A MIME-sniffing test checks whether an HTTP response tells the browser not to infer a different media type from the response body. The expected response header is:
X-Content-Type-Options: nosniffThe header is a directive for the browser. It does not set the resource’s media type; the response’s Content-Type header does that. For example, an image response should declare an appropriate image media type, while a stylesheet should declare text/css. The right type depends on what the resource actually is.
Test the exact page or resource whose behavior matters. A check of a home-page document does not establish that a JavaScript file, stylesheet, uploaded file, or another route has the same headers. Responses can differ by route, file type, server, cache, or delivery path.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Check one response in browser developer tools
- Open the page or resource you want to check. If you are investigating a script or stylesheet, load the page that requests that particular file.
- Open developer tools and select the Network panel. In most browsers, you can open developer tools from the browser menu or by right-clicking the page and choosing Inspect. Labels and shortcuts vary by browser.
- Reload the page. This makes the Network panel record the requests. If the panel offers a setting to preserve the log, enable it when a navigation would otherwise clear the requests.
- Select the relevant request. Use the request URL and resource type to distinguish the document from its scripts, stylesheets, images, and other assets.
- Inspect the response headers. Find
X-Content-Type-OptionsandContent-Type. Confirm that the first has the valuenosniffand assess whether the declared media type fits the resource.
Inspect the response, not just a request’s headers or a server’s intended configuration. A cached response, redirect, or failure can change which response you are looking at. If a request redirects, check the final resource response as well as the redirect chain when it is relevant to the problem.
Check response headers from the command line
For a quick check, use curl with the target URL. The -I option requests headers without downloading the response body:
curl -I https://example.com/In the output, look for lines similar to:
content-type: text/html; charset=utf-8
x-content-type-options: nosniffHTTP header names are case-insensitive, so capitalization may differ. The value to look for is nosniff. Replace the example URL with the page or asset you are checking. To inspect a script or stylesheet, request that asset’s URL rather than relying only on the document response.
Some servers handle a headers-only request differently from a normal GET request. If the result is missing or unexpected, compare it with a normal request that prints the response headers while discarding the body:
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
curl -sS -D - -o /dev/null https://example.com/-D - writes response headers to standard output, while -o /dev/null discards the body on systems with a Unix-style /dev/null. On Windows, use the equivalent null device supported by your shell or save the body to a file instead. Curl may show more than one header block when redirects occur; identify the headers for the final response. Do not treat a redirect response’s headers as proof that the destination has the same configuration.
Check a site with HTTP Observatory
MDN lists HTTP Observatory as an option for scanning website security configuration, including this header. A scanner report is useful for a broader configuration view, but it is not the same evidence as inspecting the exact response that a browser received. For a specific failing stylesheet or script, inspect that request directly as well.
Consider the privacy implications before submitting a domain: HTTP Observatory scan history is public. MDN also describes Observatory as designed for websites, not API endpoints, so API scan results may not accurately represent an API’s security posture. A high grade is not proof that the site is secure; a scanner cannot assess every security issue.
What nosniff changes in the browser
Scripts
For a request whose destination is a script, browsers applying nosniff block a response whose declared media type is not an expected JavaScript MIME type. If a script stops loading after you add this header, check the response’s Content-Type and the browser console. A server error page, login page, or other non-script response returned at a script URL can also create a type mismatch.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Stylesheets
For a stylesheet request, nosniff blocks a response whose declared type is not text/css. Check that the requested file is actually a stylesheet and that the server returns it with the right type, rather than returning an HTML error or redirect destination with a different type.
Other response contexts
In other response contexts, the browser uses the declared Content-Type rather than inspecting the body and guessing a type. For example, if a response is declared as text/plain, the browser does not reinterpret HTML-looking content as HTML under the behavior described by MDN. That does not make an inaccurate declaration safe or correct: the server still needs to send a suitable media type for the content and its intended use.
Interpret the result without overclaiming
- Header present with
nosniff, type appropriate: the inspected response has the expected directive and a declared type that appears consistent with the resource. This is a useful configuration check, not an overall security verdict. - Header absent: the inspected response does not show the expected directive. Check the server, framework, proxy, or CDN configuration responsible for that response, then retest the affected URL.
- Header present but value differs: verify the exact returned value. The directive to look for is
nosniff; do not assume a different value has the same effect. - Header present but
Content-Typeis wrong: correct the media type at the point that serves the resource.nosniffdoes not repair a mistakenContent-Type. - Scanner result differs from a direct check: compare the tested host, route, resource type, redirect destination, and response conditions. The scanner’s summary and a browser’s response inspection may not cover the same request.
Why the header matters—and what it cannot do
When a browser incorrectly treats content as a script or stylesheet, content that was not intended for that use can create an avenue for cross-site scripting in some circumstances. MDN recommends setting X-Content-Type-Options: nosniff alongside appropriate MIME types for served files. The combination matters: the directive tells the browser not to sniff, while Content-Type tells it what the server says the resource is.
This is a defense-in-depth measure, not a complete XSS fix, a content validation system, or a guarantee that a site is safe. A passing header check says something narrow about the response inspected. It says nothing by itself about authorization, input handling, other security headers, or vulnerabilities elsewhere in the application.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Or skip the browser setup
If you also need a visual record of a page, ScreenshotNeo can capture a screenshot from one GET request. That is separate from a MIME-header test: a screenshot is not a substitute for inspecting the raw HTTP response headers shown above.
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://example.com -o shot.webpSee the ScreenshotNeo API documentation for request options. ScreenshotNeo removes cookie banners, newsletter popups, and chat widgets before capture, with each cleanup step optional; bot checks, blank pages, and failed loads are not billed. Its MCP server lets AI agents use screenshot tools. The Free plan includes 1,000 screenshots per month without a card, and paid plans start at $5 for 3,000. Learn more at ScreenshotNeo.
Sign up for ScreenshotNeo’s free plan: 1,000 screenshots a month, no card required.
Troubleshooting common results
The header is missing in the browser but present in server configuration
Check the response actually selected in Network, including whether the request went to a different host, an asset server, or a redirect destination. Configuration on the application server may not apply to responses produced by a CDN, reverse proxy, static-file host, or error handler. Retest the exact final URL after correcting the layer that serves it.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsA script or stylesheet stops working after enabling nosniff
Inspect the blocked request’s response status, Content-Type, and body. Confirm the URL returns the intended file rather than an HTML error, access-denied page, or login response. Fix the route or media type; do not remove the directive merely to hide a resource-serving error.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Curl output does not match the browser
Make sure both requests target the same URL and final redirect destination. The browser may send cookies or other request context that changes the response; caches and intermediary servers may also return different variants. Use the Network panel’s response as the evidence for what that browser received, then compare command-line requests under matching conditions where feasible.
The scanner gives a good grade, but a resource is still wrong
Use the scanner as a site-configuration overview, then inspect the specific failing resource. A summary grade cannot establish that every route and asset returns the correct type, nor can it prove overall security.
Frequently Asked Questions
Does X-Content-Type-Options belong in the request or the response?
It is an HTTP response header. Check the headers returned by the server for the document or asset.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Does nosniff set the MIME type?
No. The server declares the media type with Content-Type; nosniff instructs the browser not to infer a different one from the content.
Can a screenshot API verify this header?
A screenshot records rendered appearance, not the raw response headers needed for this test. Inspect the response in developer tools or with an HTTP client.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
