Send X-Content-Type-Options nosniff on WordPress

Why it matters

Without it, browsers may guess a file's type from its content, so an uploaded file that looks like a script or page can be run as one. The header makes them trust the declared Content-Type.

The fix

1. Set it at the CDN or server (see their tabs), with a maintained security-headers plugin, or with the must-use plugin below.
2. The must-use plugin covers pages WordPress renders through PHP, not uploads and other static files, which the web server serves directly; set it at the server to cover those.

<?php
/*
 * Plugin Name: nosniff
 */
add_action( 'send_headers', function () {
	header( 'X-Content-Type-Options: nosniff' );
} );

Read the documentation ↗(opens in a new tab)

Related

• Reported by the X-Content-Type-Options check
• Set X-Content-Type-Options to exactly nosniff