X-Content-Type-Options header

lowsecurity-x-content-type-options

nosniff stops browsers guessing a file's type from its bytes instead of trusting the server. What it prevents, and the one-line fix.

What it is

X-Content-Type-Options: nosniff tells the browser to trust the Content-Type header a server sends and stop guessing a resource's type from its content.

Without it, some browsers sniff a response's bytes and decide for themselves what kind of file it is, regardless of what the server declared.

Why it matters

MIME sniffing exists for compatibility with servers that mislabel files, but it opens a path where attacker-controlled bytes — uploaded as an image or a plain text file — get executed as script or CSS if the browser decides that's what they 'really' are.

nosniff removes that ambiguity: a response declared text/plain stays text/plain no matter what its body looks like.

How to fix it

with a reference doc

nginx

add_header X-Content-Type-Options "nosniff" always;

.htaccess

Header always set X-Content-Type-Options "nosniff"

next.config.js

async headers() {
  return [{
    source: '/(.*)',
    headers: [{ key: 'X-Content-Type-Options', value: 'nosniff' }]
  }];
}

_headers

/*
  X-Content-Type-Options: nosniff

Reference documentation

Related checks

lowContent-Security-Policy headerContent-Security-Policy (CSP) is an HTTP response header that tells the browser which sources of scripts, styles, images and other resources a page is allowed to load. Anything not on the allow-list is blocked before it runs, regardless of how it got onto the page.mediumClickjacking protectionClickjacking protection stops another site from loading yours inside an invisible <iframe> and tricking a visitor into clicking something they didn't mean to. It's enforced with either the X-Frame-Options header or a Content-Security-Policy frame-ancestors directive.mediumStrict-Transport-Security (HSTS) headerStrict-Transport-Security (HSTS) is a response header that tells a browser to only ever connect to this host over HTTPS, for a duration set by max-age, without first trying HTTP.

This is one of the 75 checks the scanner runs. See what we check for the full list, every severity weight, and how the score is computed from them.

What it is

Why it matters

How to fix it

Related checks

See whether your own site passes x-content-type-options header.