Checks · HDR-004

HDR-004 · X-Content-Type-Options missing

Why it matters

Browsers may guess a file type. A nosniff header tells them to trust the declared type.

How we detect it

X-Content-Type-Options is absent.

How we fix it

Send X-Content-Type-Options: nosniff.

Can it be fixed automatically? Yes, with a template change

Related checks

• SEC-007 · Source maps public in production
• DB-008 · Migrations not in repo
• HDR-001 · Missing HSTS
• HDR-002 · Missing CSP