webzod
account

Set X-Content-Type-Options to exactly nosniff on Apache

headers.nosniff.invalid · effort: minutes

Why it matters

nosniff is the only value browsers understand, so any other value is ignored and type guessing stays on. A second copy added by another layer often causes it.

The fix

  1. Remove the copy in the default table and set one value in the always table, then reload.
apache 
Header onsuccess unset X-Content-Type-Options
Header always set X-Content-Type-Options "nosniff"

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.