Security headers check
The content type is not sniffed
The X-Content-Type-Options header is set to nosniff.
low severitysec.content-type-options
Run this check on your site
Runs just this check in quick mode. The report opens with the evidence and the fix.
Why it matters
Without nosniff a browser may interpret a file as a different type than the one the server declared, which turns an upload into an attack.
How to fix it
Send X-Content-Type-Options: nosniff on every response.
The details
- Category
- Security headers
- Severity of a failure
- low
- Confidence
- high
- Needs a browser
- No
- Check id
- sec.content-type-options