How to add X-Content-Type-Options
This stops browsers guessing a file's type, which blocks a class of attacks.
Why it matters
Some browsers will treat an uploaded text or image file as a script if it looks like one. Telling them not to guess closes that door, and it costs nothing.
Steps
- Add the header X-Content-Type-Options: nosniff at your host or CDN.
- Check that scripts and styles are served with the correct content types.
For your developer
X-Content-Type-Options: nosniff
Check it worked
Look for x-content-type-options: nosniff in the response headers, and confirm the page still looks right (if styles disappear, a file is being served with the wrong type).
Not sure if this affects your site?
Run a free scan to see exactly which of these your website needs.