{"id":"ia.x-content-type-options","name":"X-Content-Type-Options","verify":{"command":"curl -sI https://{domain}/","rescan":"isagentready results {domain} --checkpoint ia.x-content-type-options","expect":"X-Content-Type-Options: nosniff"},"fix":{"steps":[{"action":"Add the header to all responses.","order":1,"language":"nginx","code_example":"add_header X-Content-Type-Options \"nosniff\" always;"}],"summary":"Send X-Content-Type-Options: nosniff.","skill":{"name":"security-trust","anchor":"ia.x-content-type-options"}},"category":"security","aggregate":null,"references":[{"title":"MDN: X-Content-Type-Options","kind":"guide","url":"https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options"}],"stage":"read","lifecycle":{"introduced":"2026-08-24","revised":[],"retired":null,"replaced_by":null},"methodology_version":"2026-10-22","evidence_tier":"standard","evidence_source":{"title":"MDN: X-Content-Type-Options","url":"https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options"},"why":"This header prevents MIME type sniffing attacks. It ensures browsers and HTTP clients interpret your content exactly as intended, reducing the risk of content injection.","profiles":["browser_agent_usability","api_tool_readiness","agentic_commerce"],"score_role":"core","legacy_id":"5.5","i18n":{"nl":{"name":"X-Content-Type-Options","steps":["Voeg de header toe aan alle responses."],"why":"Deze header voorkomt MIME-sniffing. Browsers en HTTP-clients interpreteren je content precies zoals bedoeld.","fix_summary":"Stuur X-Content-Type-Options: nosniff.","verify_expect":"X-Content-Type-Options: nosniff"}},"ar_practice_ids":[],"strength":"MUST","ar_mapping":"none","evidence_type":"recommendation","detail_url":"https://isagentready.com/en/methodology/checkpoints/ia.x-content-type-options","maturity":"essential","applicability":{"mode":"always","condition":null,"surfaces":["website"]}}