The HTTPS site sends no X-Content-Type-Options: nosniff header.

XCTO_MISSING · Severity: Info

• InfoXCTO_MISSING

  The HTTPS site sends no X-Content-Type-Options: nosniff header.

  Without nosniff, some browsers guess a response's type from its content, so a file served as text can be run as a script or style.

  Recommendation: Send X-Content-Type-Options: nosniff on every response.

Reported by

• Security headers check
• Site health check

Available through the API

• Security headers check API
• Site health check API

All findings