diff --git a/adminer/include/design.inc.php b/adminer/include/design.inc.php
index f93d81f0..83d34d61 100644
--- a/adminer/include/design.inc.php
+++ b/adminer/include/design.inc.php
@@ -90,6 +90,7 @@ function page_headers() {
 	if ($adminer->headers()) {
 		header("X-Frame-Options: deny"); // ClickJacking protection in IE8, Safari 4, Chrome 2, Firefox 3.6.9
 		header("X-XSS-Protection: 0"); // prevents introducing XSS in IE8 by removing safe parts of the page
+		header("X-Content-Type-Options: nosniff");
 		header("Referrer-Policy: origin-when-cross-origin");
 	}
 }
diff --git a/changes.txt b/changes.txt
index 15430b67..2a33e236 100644
--- a/changes.txt
+++ b/changes.txt
@@ -1,4 +1,5 @@
 Adminer 4.3.2-dev:
+Add nosniff header
 PHP 7.1: Prevent warning when using empty limit
 MySQL: Remove dedicated view for replication status (added in 4.3.0)
 PostgreSQL: Sort table names (regression from 4.3.1)
diff --git a/plugins/frames.php b/plugins/frames.php
index f29b60af..32e521bc 100644
--- a/plugins/frames.php
+++ b/plugins/frames.php
@@ -22,6 +22,7 @@ class AdminerFrames {
 			header("X-Frame-Options: SameOrigin");
 		}
 		header("X-XSS-Protection: 0");
+		header("X-Content-Type-Options: nosniff");
 		header("Referrer-Policy: origin-when-cross-origin");
 		return false;
 	}