X-Content-Type-Options stops browsers from trying to guess a file's type based on its content instead of trusting the Content-Type header your server sent — that guessing ('MIME sniffing') is how attackers get a browser to execute a file uploaded as an image as if it were a script.
MIME sniffing lets browsers guess file types and execute malicious files as scripts. This header disables that behaviour entirely.
X-Content-Type-Options with the "nosniff" directive prevents a genuine, exploitable behavior in how some browsers historically handled ambiguous content — without this header, certain browsers would attempt to guess a file's actual type by examining its content rather than trusting the server's declared content type, a behavior called MIME sniffing.
This sniffing behavior creates real, exploitable risk specifically when an attacker can upload or inject content to your site that gets served with an incorrect or generic content type — without this header, a browser might reinterpret what your server intended as a harmless file, like an image, as executable script content, based on its own content-based guessing rather than respecting your server's explicit type declaration.
The "nosniff" directive instructs browsers to strictly respect your server's declared content type rather than attempting this independent guessing, closing off the specific attack vector this behavior enables — this is particularly relevant for sites accepting any form of user-uploaded content, where this protection prevents uploaded files from being reinterpreted in unintended, potentially malicious ways.
Like several other security headers in this category, implementation is genuinely straightforward — a single header value applied sitewide provides this protection with minimal configuration complexity, making this another example of substantial security value available for modest implementation effort.
The response header X-Content-Type-Options: nosniff appears on every page.
Fix it, then re-scan — the check confirms itself. No manual checkbox, the scan is the truth.
Run this check in H.I.V.E. →