diff --git a/.htaccess b/.htaccess
index 7ccb6a2..151239c 100644
--- a/.htaccess
+++ b/.htaccess
@@ -141,3 +141,9 @@ DirectoryIndex index.php index.html index.htm
     </FilesMatch>
   </IfModule>
 </IfModule>
+
+# Add headers to all responses.
+<IfModule mod_headers.c>
+  # Disable content sniffing, since it's an attack vector.
+  Header always set X-Content-Type-Options nosniff
+</IfModule>
diff --git a/includes/bootstrap.inc b/includes/bootstrap.inc
index 9f37dfc..90b7fbe 100644
--- a/includes/bootstrap.inc
+++ b/includes/bootstrap.inc
@@ -1278,6 +1278,7 @@ function drupal_page_header() {
     'Last-Modified' => gmdate(DATE_RFC7231, REQUEST_TIME),
     'Cache-Control' => 'no-cache, must-revalidate, post-check=0, pre-check=0',
     'ETag' => '"' . REQUEST_TIME . '"',
+    'X-Content-Type-Options' => 'nosniff',
   );
   drupal_send_headers($default_headers);
 }
diff --git a/modules/simpletest/tests/bootstrap.test b/modules/simpletest/tests/bootstrap.test
index f723c63..d33b259 100644
--- a/modules/simpletest/tests/bootstrap.test
+++ b/modules/simpletest/tests/bootstrap.test
@@ -128,6 +128,7 @@ class BootstrapPageCacheTestCase extends DrupalWebTestCase {
 
     $this->drupalHead('');
     $this->assertEqual($this->drupalGetHeader('X-Drupal-Cache'), 'HIT', 'Page was cached.');
+    $this->assertEqual($this->drupalGetHeader('X-Content-Type-Options'), 'nosniff', 'Browser sniffing inhibited.');
     $etag = $this->drupalGetHeader('ETag');
     $last_modified = $this->drupalGetHeader('Last-Modified');