Free tool
nosniff Header Check
Without the nosniff header, browsers may guess what a file really is — and a guess of "this looks like JavaScript" can turn an uploaded image into executable code. It is a one-line fix; this checks whether you send it.
What this checks
- ✓No nosniff header Security header
How the check works
We request your page over HTTPS and inspect the response headers for X-Content-Type-Options: nosniff — the same header every browser receives. Passive, read-only, nothing stored.
Common questions
What is MIME sniffing?
When a server labels a file with a content type, browsers historically second-guessed that label by inspecting the bytes. Helpful for broken servers decades ago; today it means a file you serve as an image can be reinterpreted and run as a script.
Why does nosniff matter if my content types are correct?
Because user-uploaded content is where it bites. If visitors can upload files that you serve back, sniffing lets a crafted upload execute inside your origin — stored XSS, with none of your own code at fault.
How do I set it?
Send X-Content-Type-Options: nosniff on every response — one line in vercel.json, a _headers file on Netlify, or your proxy config. There is no downside and nothing to tune.
All free tools · every check explained · run the full 15-point check