X-Content-Type-Options headerWhat it checks and how to fix it

What it checks

Fetches the homepage and reads X-Content-Type-Options. A missing header fails, any value other than nosniff gets a warning, and nosniff passes.

Why it matters

Without nosniff, browsers may guess a response's type from its content and run something you served as text or an image as a script or stylesheet. That turns user uploads and some JSON endpoints into a way to run code on your origin. The header is one line and has no downside.

How to fix it

Send X-Content-Type-Options: nosniff on every response, and make sure each response has the correct Content-Type.

nginx

add_header X-Content-Type-Options "nosniff" always;

Apache

Header always set X-Content-Type-Options "nosniff"

Cloudflare: Rules → Transform Rules → Modify Response Header → set X-Content-Type-Options to nosniff.

Rails sends it by default; if it is missing, restore it in config/application.rb:

config.action_dispatch.default_headers["X-Content-Type-Options"] = "nosniff"