webzod
account

Send X-Content-Type-Options nosniff on nginx

headers.nosniff.missing · effort: minutes

Why it matters

Without it, browsers may guess a file's type from its content, so an uploaded file that looks like a script or page can be run as one. The header makes them trust the declared Content-Type.

The fix

  1. Add the line to a shared snippet and include it in every server block, and in every location block that has add_header lines of its own (those replace inherited ones; nginx 1.29.3 and later can use add_header_inherit merge; instead). Run sudo nginx -t and reload.
/etc/nginx/snippets/security-headers.conf 
add_header X-Content-Type-Options "nosniff" always;

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.