Send X-Content-Type-Options nosniff on Netlify

Why it matters

Without it, browsers may guess a file's type from its content, so an uploaded file that looks like a script or page can be run as one. The header makes them trust the declared Content-Type.

The fix

1. Add the lines to _headers in the publish directory (or [[headers]] in netlify.toml) and redeploy. Functions and proxied responses must send it themselves.

/*
  X-Content-Type-Options: nosniff

Read the documentation ↗(opens in a new tab)

Related

• Reported by the X-Content-Type-Options check
• Set X-Content-Type-Options to exactly nosniff