How to Add X-Content-Type-Options: nosniff
Stop browsers from MIME-sniffing responses — a one-line header that closes an XSS vector.
A missing X-Content-Type-Options header lets browsers guess a file's type from its contents rather than trusting the declared Content-Type. That guessing can turn an uploaded file into executable script. Send X-Content-Type-Options: nosniff on every response — it is a single header with no side effects for correctly typed files.
Across every site SlapMyWeb has audited, 51.6% send X-Content-Type-Options — which leaves 48.4% with no nosniff header.
Measured from SlapMyWeb audits of live public URLs. The full aggregate is published as a CC-BY-4.0 dataset.
Why It Matters
Without this header, browsers may "sniff" a response's content type and execute, say, an uploaded image as a script. nosniff forces the browser to honour the declared Content-Type, closing that vector.
How to Fix
Send the header site-wide
X-Content-Type-Options: nosniff to every response.Set correct content types
Content-Type headers so nosniff doesn't break legitimate files.Code Fix
http# No X-Content-Type-Options headerX-Content-Type-Options: nosniffPlatform-Specific Instructions
Add via a security-headers plugin or .htaccess.
Add it under headers() in next.config.js.
Fixed that one.
Now find the rest.
A free audit ranks every issue on your site by the score points it costs — and links each one straight to its guide.
Run a free audit