Set X-Content-Type-Options to exactly nosniff on Cloudflare

headers.nosniff.invalid · effort: minutes

Why it matters

nosniff is the only value browsers understand, so any other value is ignored and type guessing stays on. A second copy added by another layer often causes it.

The fix

Create or edit a Response Header Transform Rule (Rules, Overview) with Set static, header X-Content-Type-Options, value nosniff. Set replaces what the origin sent.

Read the documentation (opens in a new tab)

Reported by the X-Content-Type-Options check
Send X-Content-Type-Options nosniff

Scan your domain to see whether this applies to you.

Why it matters

The fix

Related