Send X-Content-Type-Options nosniff on Vercel

Why it matters

Without it, browsers may guess a file's type from its content, so an uploaded file that looks like a script or page can be run as one. The header makes them trust the declared Content-Type.

The fix

1. Add the header to vercel.json (merge into an existing headers array) and redeploy.

{
  "headers": [
    {
      "source": "/(.*)",
      "headers": [{ "key": "X-Content-Type-Options", "value": "nosniff" }]
    }
  ]
}

Read the documentation ↗(opens in a new tab)

Related

• Reported by the X-Content-Type-Options check
• Set X-Content-Type-Options to exactly nosniff