X-Content-Type-Options and Referrer-Policy

`X-Content-Type-Options: nosniff` prevents browsers from MIME-sniffing a response away from the declared `Content-Type`. Without this header, Internet Explorer and older Chrome would inspect the first bytes of a response to guess the content type, overriding the server's declaration. An attacker who can upload a file named `.jpg` but containing JavaScript could trigger script execution if the browser sniffs it as `text/javascript`. The `nosniff` directive forces the browser to respect the `Content-Type` header literally. The `Referrer-Policy` header controls how much information the browser includes in the `Referer` header when navigating from your site to another. Without a policy, the browser sends the full URL including query strings — potentially leaking search terms, session tokens in URLs, or internal path structures to third-party servers referenced by your page. `strict-origin-when-cross-origin` (the recommended default) sends the full URL for same-origin navigations but only the origin (no path or query) for cross-origin navigations over HTTPS, and nothing for HTTPS-to-HTTP transitions. The Permissions Policy header (formerly Feature Policy) allows servers to control which browser features and APIs the page and any embedded iframes may use. Disabling unused features like geolocation, microphone, camera, and payment reduces the attack surface — a compromised script cannot silently activate the webcam if the Permissions Policy header denies it at the browser level. Use the Permissions Policy Explainer at permissionspolicy.com to generate the correct syntax for your requirements.

Example

# Apache .htaccess: security headers for a static or PHP site

<IfModule mod_headers.c>
    # MIME-sniffing protection
    Header always set X-Content-Type-Options "nosniff"

    # Referrer policy — leaks minimal info to third parties
    Header always set Referrer-Policy "strict-origin-when-cross-origin"

    # Permissions policy — disable unneeded browser features
    Header always set Permissions-Policy "geolocation=(), microphone=(), camera=(), payment=(), usb=(), interest-cohort=()"

    # Clickjacking
    Header always set X-Frame-Options "SAMEORIGIN"

    # HSTS (only if your entire site is HTTPS)
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

    # Remove server info headers
    Header always unset X-Powered-By
    Header always unset Server

    # Cross-origin isolation headers (required for SharedArrayBuffer/high-res timers)
    Header always set Cross-Origin-Opener-Policy "same-origin"
    Header always set Cross-Origin-Embedder-Policy "require-corp"
    Header always set Cross-Origin-Resource-Policy "same-origin"
</IfModule>

# Serve static files with correct MIME types to make nosniff safe
AddType text/javascript .js
AddType text/css        .css
AddType image/svg+xml   .svg

HTML

Full Editor

Related Resources

Web Security Reference

Complete tag & property list

Web Security How-To Guides

Step-by-step practical guides

Web Security Exercises

Practice what you've learned