Add X-Content-Type-Options: nosniff

Web headers · about 5 min

In plain words

Browsers sometimes "guess" what a file is. This header tells them to trust the declared type, so an uploaded text file can never be run as a script.

What can go wrong

User uploads or misconfigured files may be executed as scripts or styles.

How to fix it

Pick the platform your site runs on. Not sure? Forward this page to whoever manages your website.

Nginx

# inside the server { } block
add_header X-Content-Type-Options "nosniff" always;

Apache / .htaccess

<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
</IfModule>

Cloudflare

Rules → Transform Rules → Modify Response Header
  Set static: X-Content-Type-Options = nosniff

# Cloudflare Pages: add to public/_headers
/*
  X-Content-Type-Options: nosniff

Vercel

// vercel.json
{ "headers": [ { "source": "/(.*)", "headers": [
  { "key": "X-Content-Type-Options", "value": "nosniff" }
] } ] }

Netlify

# public/_headers
/*
  X-Content-Type-Options: nosniff

WordPress

// functions.php (child theme) — or use your security plugin's "HTTP headers" setting
add_action('send_headers', function () {
  header('X-Content-Type-Options: nosniff');
});

Check that it worked

Re-run the ProbeHunt check.

Re-run the free check

References

MDN: X-Content-Type-Options