Missing X-Content-Type-Options Header

What this finding means

Your site does not send X-Content-Type-Options: nosniff. Some browsers may fall back to inspecting response bytes to guess a content type rather than trusting your declared Content-Type, which historically has been used to get a browser to execute a file (e.g. an upload) as HTML or JavaScript.

Why it matters

MIME sniffing has historically let attackers upload a file that is technically an image or text file but that a browser reinterprets as HTML or JavaScript and executes — turning an upload feature into a stored-XSS vector. It's a lower-severity header than HSTS or CSP because modern browsers sniff far less aggressively than they used to, but it's a one-line, zero-downside header with no legitimate reason to omit.

What Nivaronix checks

Nivaronix's security headers checker inspects the response headers your site sends and reports whether X-Content-Type-Options is present. This is a security misconfiguration check based on the header's presence and configuration — not a vulnerability scan, exploit attempt, or penetration test.

Evidence example

Example only, for illustration — not evidence from a live scan of any specific site.

HTTP/1.1 200 OK
(no X-Content-Type-Options header present)

How to fix it

add_header X-Content-Type-Options "nosniff" always;

Header always set X-Content-Type-Options "nosniff"

Rules → Transform Rules → Modify Response Header → set `X-Content-Type-Options` to `nosniff`.

Verify the fix

Re-run a scan on your domain, or check manually with curl -sI https://your-domain.example, and confirm X-Content-Type-Options now appears in the response with the expected value.

Standards reference

MDN — X-Content-Type-Options. See the methodology page for exactly how this finding is scored.