Readiness check · Harden lane · weight 3

X-Content-Type-Options: nosniff

The homepage response includes X-Content-Type-Options: nosniff.

Why it matters

It stops browsers from guessing a file's type, which blocks a class of attacks where an uploaded file is run as a script.

Send X-Content-Type-Options: nosniff on all responses and make sure each file is served with the correct Content-Type.

The homepage response includes X-Content-Type-Options: nosniff.

Observed: nosniff header present.

Not observed: nosniff header not sent.

Limit: Read from the homepage response only; other pages or regions may send different headers.

Cloudflare: Add the header with a response header transform rule.
Amazon CloudFront: Enable it in a response headers policy (security headers section).
Next.js: Add it in next.config.js headers().
Vercel: Add it in vercel.json headers.
Drupal: The Security Kit module can set common security headers.