Missing X-Content-Type-Options header

LowAuto-fixableSecurityPer-page checksecurity_no_xcto

What this means

The response does not send X-Content-Type-Options, so browsers may MIME-sniff a response into a type it was not declared as.

How to fix it

Send X-Content-Type-Options: nosniff.

Fix effort

This check is auto-fixable: the change can be written and validated automatically, so CrawlX can open it as a pull request for review.

Authoritative source

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers

Related checks

More in Security

Redirect downgrades HTTPS to HTTP Mixed content on an HTTPS page Content-Security-Policy is report-only Missing Content-Security-Policy header Missing HSTS header All checks

Find every page this affects

CrawlX runs this check — and 161 others — across your whole site, ranks the findings by estimated impact, and opens the fixable ones as pull requests. Free for 500 URLs.

Start crawling free Browse all checks