webzod
account

Set X-Content-Type-Options to exactly nosniff

headers.nosniff.invalid · effort: minutes

Why it matters

nosniff is the only value browsers understand, so any other value is ignored and type guessing stays on. A second copy added by another layer often causes it.

The fix

  1. Find every layer that sets X-Content-Type-Options (application, plugin, web server, CDN) and keep one.
  2. Make its value exactly nosniff.
http 
X-Content-Type-Options: nosniff

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.