Checks
X-Content-Type-Options
Checks that the homepage response includes X-Content-Type-Options set to nosniff, which stops browsers from guessing a file's type and executing it unexpectedly.
What this check looks for
This check reads the homepage's X-Content-Type-Options header and checks whether its value includes nosniff. If it does, it passes. If the header is absent or doesn't include that value, it warns.
Why it matters
Without nosniff, some browsers will inspect a response's actual bytes and guess its content type rather than trusting the declared Content-Type header — so a file served as, say, text/plain that happens to contain HTML-like content could get interpreted and executed as HTML or a script instead of being displayed as inert text. This "MIME sniffing" behavior has historically been exploited to smuggle executable content past upload validation that only checked the declared content type. Setting nosniff is a single, low-cost header that removes an entire class of this risk, and like the other security headers here, it's a general hardening measure that supports the same site-trustworthiness baseline search engines and AI crawlers implicitly factor into how much they trust a domain.
How to fix it
Send the header on every response, not just HTML pages:
X-Content-Type-Options: nosniffMost frameworks and reverse proxies (nginx, a CDN's edge config, or an app-level security middleware) can add this header globally in one place rather than per-route.
See how your site scores on this check