EngineeringScoreSecurity Small
Add X-Content-Type-Options header
Without X-Content-Type-Options: nosniff, some browsers will try to guess a resource's type by inspecting its contents rather than trusting the declared Content-Type. That "MIME sniffing" behavior is a legacy compatibility feature, but it also gives attackers a way to get a browser to execute a file (like a user-uploaded image) as if it were a script.
Why it matters
Without nosniff, browsers may reinterpret a file as a different type, for example treating an uploaded image as executable JavaScript, which attackers can exploit to run malicious scripts.
How to fix
- 1 Add X-Content-Type-Options: nosniff to all responses.
- 2 Ensure correct Content-Type headers are already being sent for every resource.
Common mistakes
- Adding the header only to HTML responses and forgetting it needs to apply site-wide, including to user-uploaded content and API responses.
- Assuming nosniff alone is sufficient protection against the underlying upload-handling risk, when the real fix also requires sending correct Content-Type headers everywhere.
- Setting the header at the CDN but not at the origin, so it silently disappears if a request ever bypasses the CDN.
How to verify
- 1 Inspect the response headers for X-Content-Type-Options: nosniff on both HTML pages and static assets.
- 2 Check that every response, including file uploads and API endpoints, declares an accurate Content-Type so nosniff cannot expose a mismatch.
- 3 Re-run a header scanner site-wide, not just on the homepage, since headers are often set per-route rather than globally.
Related checks
Ready to see where you stand?
Scan your site and get your Engineering Score with a prioritized roadmap in under a minute, no signup required.