AI Cyber Shield

How to add X-Content-Type-Options: nosniff

This header tells the browser not to guess a file's type. Without it, an uploaded file can be interpreted as a script and run.

How to fix it, by platform

WordPress

Where: your theme's functions.php (or a snippets plugin)

add_action('send_headers', function () {
  header("X-Content-Type-Options: nosniff");
});

WordPress sends the X-Content-Type-Options header on every page load.

How to confirm: Reload the site and check the response headers include `X-Content-Type-Options`.

Cloudflare

Where: Cloudflare dashboard → Rules → Transform Rules → Modify Response Header → Add

Set static  —  Header name: X-Content-Type-Options  —  Value: nosniff

Cloudflare injects the X-Content-Type-Options header at the edge, no server change needed.

How to confirm: Reload the site and check the response headers include `X-Content-Type-Options`.

Vercel / Next.js

Where: next.config.js → async headers()

module.exports = {
  async headers() {
    return [{ source: "/(.*)", headers: [
      { key: "X-Content-Type-Options", value: "nosniff" },
    ]}];
  },
};

Next.js sets the X-Content-Type-Options header on every route.

How to confirm: Reload the site and check the response headers include `X-Content-Type-Options`.

Netlify

Where: a `_headers` file in your publish directory (or netlify.toml)

/*
  X-Content-Type-Options: nosniff

Netlify applies the X-Content-Type-Options header to all paths (`/*`).

How to confirm: Reload the site and check the response headers include `X-Content-Type-Options`.

Nginx

Where: nginx.conf — inside your `server { }` block, then reload nginx

add_header X-Content-Type-Options "nosniff" always;

Adds the X-Content-Type-Options header for every response.

How to confirm: Reload the site and check the response headers include `X-Content-Type-Options`.

Apache

Where: .htaccess (or the vhost config), then restart Apache

Header always set X-Content-Type-Options "nosniff"

Adds the X-Content-Type-Options header via mod_headers.

How to confirm: Reload the site and check the response headers include `X-Content-Type-Options`.

IIS

Where: web.config — inside <system.webServer><httpProtocol><customHeaders>

<add name="X-Content-Type-Options" value="nosniff" />

Adds the X-Content-Type-Options header in IIS.

How to confirm: Reload the site and check the response headers include `X-Content-Type-Options`.

Your web server

Where: your web server's response-header configuration

X-Content-Type-Options: nosniff

Configure your server/CDN to send this header on all responses.

How to confirm: Reload the site and check the response headers include `X-Content-Type-Options`.

Not sure your site needs this fix? A scan checks this and dozens of other things and shows what yours is missing.

Scan your site free

Related guides