Security headers explained
Security1 min readFixes check x-content-type-options
A handful of response headers stop content sniffing, framing and referrer leaks. They take minutes to add and rarely break anything.
Step by step, with screenshots: Apache .htaccess for an A grade: headers, redirects, caching →
Check your own site
Runs this check and the other 186, free, in about 45 seconds.
What a passing site looks like
- X-Content-Type-Options: nosniff is setwarning · −1.5 ptseffort S
X-Content-Type-Options header is missing
Why it matters. Without it, browsers may guess a file's type from its content and run an uploaded image or text file as a script.
How to fix it.
- Send the header: X-Content-Type-Options: nosniff on every response.