FmindSecurity guide
File type protection (X-Content-Type-Options)
Without this setting, browsers may guess what kind of file they receive, so a file that was uploaded or labelled by mistake could run as code in your visitors’ browsers.
Who can help
Your web developer or web host
Inspect before changing
Use these steps for a website or email domain you manage. Complete the capitalized placeholders with your own values. If a step refers to saved evidence, run the free check and verify your domain to open the private report. Use the exact hostname or DNS query name shown there.
- In the browser’s developer tools (Network tab), look at X-Content-Type-Options and at the Content-Type of scripts and stylesheets. Have wrongly labelled files corrected by whoever manages them before changing the header.
Response header: X-Content-Type-Options
Expected value: nosniff
Script and stylesheet Content-Type: VERIFYWhat to do
Ask your developer or host to add the header X-Content-Type-Options: nosniff, a standard one-line setting. Beforehand, make sure your scripts and stylesheets are served with the correct file type, or they may stop loading. Test your pages afterwards and keep the old configuration so you can switch back.
How to verify the change
Run this check again: this item should show Good. Then check that your pages still look and work normally.
What this check can establish
We check your homepage only, not every file your site serves.