X-Content-Type-Options: nosniff

What this means

Passing means the response carries X-Content-Type-Options: nosniff. Failing means it is absent, so a browser is free to inspect the bytes of a file and decide for itself what kind of file it is. The header pins every response to the Content-Type your server declared.

How we test it

We read the headers on the home page response and look for x-content-type-options with the value nosniff. Present with that value passes. Absent fails. The kit sets the header for every route, so we check only the home page.

Why it matters

Stops browsers from guessing content types into executable ones. Without it, a file a user uploaded as an image, or a text response from an API, can be sniffed and run as script if the bytes look right. It is a one-line header with no known downside, which is why it is in the same template as the other five and should never be missing on its own.

The fix

Add X-Content-Type-Options: nosniff to the headers block for /(.*) in vercel.json on a static site, or to the securityHeaders array used by headers() in next.config.ts on Next.js. Push, wait once, and confirm with curl -sI https://YOUR_DOMAIN | grep -i '^x-content-type-options', expected x-content-type-options: nosniff. The full runbook is in the Fix Kit, Module 01.

Prompt for your AI

Paste this into the coding agent that built the app. It reproduces the finding and stops before changing anything; the fix steps are in the kit.

Do not change anything. This is a verification pass.
Run: curl -sI https://YOUR_DOMAIN | grep -i '^x-content-type-options' and show me the output, or tell me it is empty.
Run the same against https://YOUR_DOMAIN/ANY_INNER_PAGE and show me the output.
Open vercel.json or next.config at the repo root and show me where response headers are set, or tell me they are not.
List what it would take to add the header to every route, and stop there.
Run: curl -sI https://YOUR_DOMAIN | grep -ic '^x-content-type-options: nosniff' and show me the output. Expected on a passing site: 1.