# Security headers explained

> A handful of response headers stop content sniffing, framing and referrer leaks. They take minutes to add and rarely break anything.

Security · HTML version: https://getreport.app/learn/security-headers

## X-Content-Type-Options header

Passing looks like: X-Content-Type-Options: nosniff is set.

**Why it matters.** Without it, browsers may guess a file's type from its content and run an uploaded image or text file as a script.

**How to fix it.**

1. Send the header: X-Content-Type-Options: nosniff on every response.

Check your own page: https://getreport.app/