Set X-Content-Type-Options to exactly nosniff on Caddy
Why it matters
nosniff is the only value browsers understand, so any other value is ignored and type guessing stays on. A second copy added by another layer often causes it.
The fix
- Set it with the > prefix so it replaces the application's value, then reload.
Caddyfile
header >X-Content-Type-Options nosniff Related
- Reported by the X-Content-Type-Options check
- Send X-Content-Type-Options nosniff
Scan your domain to see whether this applies to you.