webzod
account

Send X-Content-Type-Options nosniff on Cloudflare

headers.nosniff.missing · effort: minutes

Why it matters

Without it, browsers may guess a file's type from its content, so an uploaded file that looks like a script or page can be run as one. The header makes them trust the declared Content-Type.

The fix

  1. Open Rules, Overview, choose Create rule, Response Header Transform Rule, and add the operation below for this host. The DNS record must be Proxied.
  2. Alternatively turn on the Add security headers Managed Transform (Rules, Settings, Managed Transforms). It also sets X-Frame-Options SAMEORIGIN, Referrer-Policy same-origin, X-XSS-Protection and Expect-CT, so check those suit the site.
text 
Rule type:     Response Header Transform Rule
If:            Hostname equals example.com
Operation:     Set static
Header name:   X-Content-Type-Options
Value:         nosniff

The examples use example.com. Replace it with your own domain.

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.