Missing X-Content-Type-Options header: nosniff and how to fix
If a scanner says “X-Content-Type-Options header missing,” the live HTTPS response has no nosniff. That header tells the browser to trust the Content-Type you sent—and not guess. Here is what it does and how to fix it.
What X-Content-Type-Options does
Browsers historically “sniffed” bytes to decide whether a download was HTML, an image, or executable script—even when the server sent a different Content-Type. That MIME confusion is a classic XSS and drive-by path: upload a file the site serves as text/plain, and a sniffer still runs it as HTML. X-Content-Type-Options: nosniff tells supporting browsers to stick to the declared type.
Missing X-Content-Type-Options header — how to fix
A missing X-Content-Type-Options header means the response never sent nosniff. Fix: add X-Content-Type-Options: nosniff at the CDN, load balancer, or web server on every hostname users hit (apex and www). Then re-run the free security headers checker. CrowWake warns on the same missing-header signal hourly, so a later “simplify headers” deploy cannot drop it quietly.
What CrowWake checks
On HTTPS we look for an X-Content-Type-Options header. Missing → warn. Present → we summarize the value (almost always nosniff) so you notice accidental deletes after a CDN or origin change. The free security headers checker uses the same signal with no login; CrowWake’s hourly flock watches it afterward.
nosniff is the value that matters
Publish exactly: X-Content-Type-Options: nosniff. Other values are not useful in practice. Pair it with a correct Content-Type on each response—nosniff does not invent a type; it refuses to override the one you set. Static assets, APIs, and HTML pages all benefit when the edge or origin adds the header once.
How it fits with the other security headers
HSTS locks browsers onto HTTPS. X-Frame-Options (or CSP frame-ancestors) stops clickjacking. The HTTP→HTTPS redirect closes the cleartext door. X-Content-Type-Options closes MIME sniffing. CrowWake’s free security headers checker reports all of these in one pass so a “simplify headers” deploy cannot silently drop nosniff while HSTS still looks fine.
Quick publish triage
1) Run the free security headers checker and note the X-Content-Type-Options row. 2) Add X-Content-Type-Options: nosniff at the CDN, load balancer, or web server (apex and www if both are live). 3) Confirm Content-Type on HTML and downloadable files still matches what you intend. 4) Re-check the live response. 5) Add the domain so CrowWake crows if nosniff disappears after a rebuild.
If CrowWake crows
Missing X-Content-Type-Options → publish nosniff at the edge or origin. Present then gone → restore after a theme, panel, or “minify headers” change. Odd value instead of nosniff → replace with nosniff. After a fix, re-run the free security headers checker and keep watching. Deep dives: HSTS, X-Frame-Options, and HTTPS redirect use the same checker.
Watch this on CrowWake
Add the domain, leave the boxes checked, and the flock will crow when this drifts.
Or try the free security headers checker with no login.
Related: security headers monitoring, HSTS guide, X-Frame-Options, HTTPS redirect, and the security headers & open ports guide (same free checker covers all four).