Send X-Content-Type-Options nosniff on Caddy
Why it matters
Without it, browsers may guess a file's type from its content, so an uploaded file that looks like a script or page can be run as one. The header makes them trust the declared Content-Type.
The fix
- Add the line to the site block and reload Caddy.
Caddyfile
header >X-Content-Type-Options nosniff Related
Scan your domain to see whether this applies to you.