X-Content-Type-Options missing

Check id: hdr.xcto_missing · fix effort: low

What it means

Browsers may second-guess your file types, which can turn innocent uploads into executable code. One static header removes the whole problem.

The technical detail

Missing X-Content-Type-Options: nosniff.

How to fix it

  1. Add X-Content-Type-Options: nosniff to all responses.

Does your domain have this problem?

Run a free scan, takes about ten seconds.