Header Security
X-Content-Type-Options: nosniff Header Check
The X-Content-Type-Options: nosniff header prevents browsers from interpreting files with an incorrect MIME type. Learn how to configure it to enhance your site security.
What this test checks
This test checks for the presence of the HTTP X-Content-Type-Options: nosniff header. This header prevents the browser from interpreting a file with a MIME type different from that declared in the Content-Type header. It protects against MIME sniffing attacks, where an attacker attempts to execute a malicious file (e.g., script) by disguising it as an image.
Our recommendation
Add the HTTP header 'X-Content-Type-Options: nosniff' to all responses on your site. In Apache, use 'Header set X-Content-Type-Options nosniff'. In Nginx, use 'add_header X-Content-Type-Options nosniff always'. Verify that your server sends this header for all file types (HTML, CSS, JS, images, etc.). Test with browser developer tools.
Security tests
Read more
Header Security