webzod
account

Set X-Content-Type-Options to exactly nosniff on nginx

headers.nosniff.invalid · effort: minutes

Why it matters

nosniff is the only value browsers understand, so any other value is ignored and type guessing stays on. A second copy added by another layer often causes it.

The fix

  1. Hide the application's copy and set one value, run sudo nginx -t and reload. Use fastcgi_hide_header for PHP-FPM.
nginx 
proxy_hide_header X-Content-Type-Options;
add_header X-Content-Type-Options "nosniff" always;

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.