X-Content-Type-Options header is missing

SeverityLow

ScopeWhole site

EffortSmall

Verified bySecurity scan (weekly, or Re-scan)

Rule keysec_nosniff_missing

Short answer

Your home page is served without X-Content-Type-Options: nosniff. Without it, a browser may ignore the declared Content-Type and guess the type from the content, so a file uploaded as an image or text could end up being run as a script or applied as a stylesheet. The header has a single valid value and takes one line to add.

Why it matters

MIME sniffing matters wherever users can upload or influence files on your domain: media uploads, form attachments, user-generated content, JSONP endpoints. With nosniff, browsers refuse to run a script or apply a stylesheet unless it is served with the correct type. It is a low-effort hardening step with no ranking effect.

How Glimana detects it

Glimana reads the response headers of your HTTPS home page. The check passes only when X-Content-Type-Options is exactly nosniff (letter case and surrounding spaces are ignored); a missing header or any other value fails with low severity. Only the home page response is checked, so make sure the header is sent site-wide and not only there.

How to fix it

Watch out

Once the header is on, scripts and stylesheets served with the wrong type stop loading: a .js file must come with a JavaScript type such as text/javascript, and a .css file with text/css. Check the browser console for blocked resources, especially files served by custom PHP routes or a misconfigured CDN. In Nginx, a location block with its own add_header drops the inherited headers, so the header can vanish on some paths.

Find the finding in Glimana. Open Security; this check is in the Security headers group, with the evidence from the last scan under its title. The same problem is listed under Issues › X-Content-Type-Options header is missing.
Apply the fix on your platform.

WordPressCloudflareApache / Nginx

WordPress sends nosniff on admin-ajax and REST API responses, but not on public pages. Add it in .htaccess (Apache, mod_headers): Header always set X-Content-Type-Options "nosniff". Many security plugins offer the same switch; use one place only.

Two built-in options, either is enough: Rules › Settings › Managed Transforms › Add security headers (also adds X-Frame-Options: SAMEORIGIN and a few others), or the No-Sniff Header switch in the HSTS settings under SSL/TLS › Edge Certificates › HTTP Strict Transport Security (HSTS).

Nginx: add_header X-Content-Type-Options "nosniff" always; in the server block, and keep include mime.types; in the http block so files get correct types.
Apache: Header always set X-Content-Type-Options "nosniff"; mod_mime sets the types from file extensions.
Check it in Glimana. Press Re-scan on the Security page (up to two scans an hour) or wait for the weekly scan on Sunday; the problem closes when the check passes.

How the fix is verified

Press Re-scan on the Security page (or wait for the weekly Sunday scan); the problem closes when the check passes.