Defaults.Exposed › Stats › Web security headers
What percent of websites set X-Content-Type-Options?
As of July 28, 2026 · census snapshot 2026-07-28
As of July 28, 2026, 7.3% of the 276 million domains graded in the Defaults.Exposed census send X-Content-Type-Options: nosniff — 20,058,145 domains protected against MIME-sniffing attacks.
Cite this
Statistic current as of July 28, 2026. Recomputed from the live census each edition; the number on this page and the machine-readable twin always match. Please cite Defaults.Exposed and link this page.
Defaults.Exposed, "What percent of websites set X-Content-Type-Options?" (as of July 28, 2026). https://defaults.exposed/stats/what-percent-of-websites-set-x-content-type-options
Permalink:https://defaults.exposed/stats/what-percent-of-websites-set-x-content-type-options · Machine-readable:nosniff-adoption.json · Licence:open data
Methodology: how we grade the internet · Source data: defaults.exposed/data. Updated with each census edition.
Related statistics
- What percent of websites have a Content-Security-Policy?
- What percent of websites block clickjacking?
- What percent of websites set a Referrer-Policy?
- How many websites pass every security-header check?
- How many websites use cross-origin isolation headers?
- How many websites deploy HTTPS, HSTS and CSP together?