Security
Stop browsers guessing what your files are
Your site does not tell browsers to trust the file type it declares, so a browser may guess at it and treat a file as something it is not.
Why it matters
If a browser decides an uploaded file is a script rather than a picture, it can run that file. One header with one value prevents it, and it costs nothing in speed or compatibility. This is the simplest security improvement available, which is why leaving it unset is hard to defend.
How you would notice it
- A security scan reported a missing X-Content-Type-Options header.
- A file behaves differently in one browser than in another.
- Your host security report lists this header among the missing ones.
What to do
Stage 1
- Add the header in your server or host configuration. The only value that works is nosniff.
nosniff is a literal value. Any other word is ignored by browsers, so the check would stay failing.
# nginx
add_header X-Content-Type-Options "nosniff" always;Stage 2
- If your host offers a security or headers panel instead of a configuration file, switch on the content type sniffing protection there.
It is usually a checkbox on the same screen as the other security headers, rather than a separate product.
- If your site is on a static host, use the headers file that host documents. This is a complete file for a site hosted on Cloudflare Pages or Netlify.
/*
X-Content-Type-Options: nosniffStage 3
- Do not try to set this with a meta tag in your HTML. The instruction has to be on the response, so a tag in the page has no effect at all.
Unlike some other settings, there is no in-page equivalent for this one.
How to check it worked
Confirm it worked
Request the address with a header check and confirm x-content-type-options appears with the value nosniff. Check it on an ordinary page rather than a special one, because a header set only for certain paths will not cover the whole site. Then re-run the Siege Test and confirm the recommendation is gone.