Security headers

Stop browsers guessing file types

Why this matters

A browser that guesses a file's type could treat an uploaded file as a script. A short server instruction helps prevent this.

What to do

1. Ask your host whether you can add response headers. These are instructions the server sends alongside a page or file.
2. Set X-Content-Type-Options: nosniff. Make sure the server also sends the correct file type for each file.
3. What to tell your web developer: Please add X-Content-Type-Options: nosniff and check that scripts and stylesheets have the correct Content-Type, which tells the browser what kind of file it received.

How to check the fix

Check that the site's design and interactive features still work. Run the checker again and look for a pass for file types not being guessed.