snag.page

Every check ยท Headers

nosniff

headers/nosniff

What it checks

X-Content-Type-Options: nosniff.

Why it matters

It stops browsers guessing a file's type and running as a script something that wasn't meant to be one.

How to fix it

  1. Send the header below with every response.
Header
X-Content-Type-Options: nosniff

Check a site for this and everything else: snag.page. More on headers: Bot challenge Content-Security-Policy Framing Referrer policy Software versions End-of-life software CORS Permissions-Policy Cross-Origin-Opener-Policy