http.x_content_type_options Reviewed July 2026

Quick fix

Set correct `Content-Type` values for every response and uploaded file.

What this finding means

SecuTest requires the HTTPS response header value `nosniff`. The control is small but useful defense in depth, especially for script and stylesheet responses and user-controlled uploads.

Interpretation boundary Use the exact evidence in your report. SecuTest reports externally observable conditions; it does not assume ownership, exploitability, compromise, or business intent when those cannot be proven remotely.

Associated attack or threat scenario

Threat type MIME confusion and content execution

How the attack or failure scenario works

MIME sniffing is a browser behavior that guesses a response type from its bytes. If an attacker can upload or influence content served with an incorrect type, the browser may execute it as script or stylesheet. `nosniff` tells compatible browsers to respect the declared `Content-Type`.

Conditions and limitations

  • Attacker-controlled or misclassified content is served from a trusted origin.
  • The response has an incorrect or ambiguous `Content-Type`.
  • The browser would otherwise sniff the content into an executable type.

Why it matters

Security and business impact Without `X-Content-Type-Options: nosniff`, browsers may interpret a response as executable content despite an incorrect declared MIME type.

Step-by-step fix

Where to make the change

  • The outermost component emitting the public HTTP response: CDN, reverse proxy, ingress, web server, or application middleware.
  • Apply the control consistently to normal pages, redirects, error responses, and relevant subdomains.

Remediation procedure

  1. Set correct `Content-Type` values for every response and uploaded file.
  2. Add `X-Content-Type-Options: nosniff` at the outermost public response layer.
  3. Store untrusted uploads on a separate origin and force safe download handling where appropriate.
  4. Test scripts, styles, JSON, downloads, and error responses after deployment.

Commands and configuration examples

Replace example values with the hostname, selector, IP address, port, provider, or policy values shown in your SecuTest evidence. Review every example before production use.

Nginx
add_header X-Content-Type-Options "nosniff" always;

Apache
Header always set X-Content-Type-Options "nosniff"

Cloudflare
Use a Response Header Transform Rule to set X-Content-Type-Options to nosniff.

Verify the fix

  1. Inspect response headers with curl.
  2. Confirm the value is exactly `nosniff`.
  3. Verify JavaScript and CSS resources still load with correct MIME types.
  4. Test representative user-upload and download paths.
Confirm the externally visible result

After DNS, CDN, certificate, mail, or application propagation completes, run a fresh SecuTest scan and compare the new evidence with the original finding.

Re-scan your domain

Common mistakes

  • Adding `nosniff` while serving JavaScript as `text/plain`, causing legitimate breakage.
  • Applying the header only to the home page.
  • Using the header as a substitute for upload isolation and correct MIME handling.

Authoritative references