Send X-Content-Type-Options nosniff

Why it matters

Without it, browsers may guess a file's type from its content, so an uploaded file that looks like a script or page can be run as one. The header makes them trust the declared Content-Type.

The fix

1. Send the header below on every response.
2. Check that scripts are served as text/javascript and stylesheets as text/css; with nosniff, browsers refuse a script or stylesheet served with the wrong type.

X-Content-Type-Options: nosniff

Read the documentation ↗(opens in a new tab)

Related

• Reported by the X-Content-Type-Options check
• Set X-Content-Type-Options to exactly nosniff