X-Content-Type-Options: nosniff

nosniff stops the browser guessing a file type from its contents, which is how an uploaded image ends up executed as a script.

• Help center

Browsers used to “sniff” files: if a response looked like a script or HTML, they treated it as one, whatever its declared type. That made it possible to upload a file disguised as an image or text and have the browser execute it. The X-Content-Type-Options: nosniff header turns sniffing off: the browser trusts only the Content-Type the server sent, and refuses to run a script or apply a stylesheet whose type does not match.

How SiteScan grades it

The header has only one valid value. Exactly nosniff is “Strong”; any other value is “Weak”, because browsers ignore it; no header is “Missing”.

How to set it

• nginx: add_header X-Content-Type-Options "nosniff" always;
• Apache: Header always set X-Content-Type-Options "nosniff"

Send it on every response, not just HTML. Before enabling it, check that your server sends correct types — text/css for stylesheets, text/javascript or application/javascript for scripts — otherwise those files will stop loading. This is one of the cheapest headers to add and rarely breaks anything. See the full set in the security headers overview.