Send X-Content-Type-Options nosniff on Apache

Why it matters

Without it, browsers may guess a file's type from its content, so an uploaded file that looks like a script or page can be run as one. The header makes them trust the declared Content-Type.

The fix

1. Add the line to the virtual host or .htaccess (mod_headers; on Debian and Ubuntu sudo a2enmod headers) and reload Apache.

Header always set X-Content-Type-Options "nosniff"

Read the documentation ↗(opens in a new tab)

Related

• Reported by the X-Content-Type-Options check
• Set X-Content-Type-Options to exactly nosniff