When a browser downloads a file, it normally trusts the server's stated file type (the "Content-Type"). But some browsers will second-guess this and try to figure out the type themselves by peeking at the contents — a behaviour called MIME sniffing. The X-Content-Type-Options header, set to nosniff, tells the browser to stop guessing and trust what the server says.
Why it matters
MIME sniffing can be tricked. If someone uploads a file that looks like a harmless image but contains script code, a sniffing browser might decide it's actually a script and run it — on your site, in your visitor's browser. Adding this header closes that gap with a single line.
How to fix it
The goal in every case is to send this header with your responses:
X-Content-Type-Options: nosniff
WordPress
If you can edit your theme's functions.php, add:
add_action('send_headers', function () {
header('X-Content-Type-Options: nosniff');
});
Alternatively, many security plugins let you add this header from their settings without editing code.
Nginx
In your server or location block:
add_header X-Content-Type-Options "nosniff" always;
Then reload: nginx -s reload
Apache
In your .htaccess file or virtual host config (requires mod_headers):
Header set X-Content-Type-Options "nosniff"
Cloudflare
Go to your site's dashboard, then Rules → Transform Rules → Modify Response Header. Create a rule to set:
X-Content-Type-Options: nosniff
Apply it to all incoming requests and deploy.
How to check it worked
Reload your site and open your browser's developer tools (F12), then look under the Network tab at the response headers for the page — you should see X-Content-Type-Options: nosniff listed. You can also run curl -I https://yourdomain.com from a terminal and confirm the header appears.