Methodology
X-Content-Type-Options
ia.x-content-type-options · 5.5
Read
MUST
Recommendation
Why it matters
This header prevents MIME type sniffing attacks. It ensures browsers and HTTP clients interpret your content exactly as intended, reducing the risk of content injection.
How to fix it
Send X-Content-Type-Options: nosniff.
-
Add the header to all responses.
add_header X-Content-Type-Options "nosniff" always;
Verify
curl -sI https://{domain}/
Expected: X-Content-Type-Options: nosniff
Run a new scan for this checkpoint:
isagentready results {domain} --checkpoint ia.x-content-type-options
Details Mapping, lifecycle and references
- AR mapping
- No AR practice
- Evidence source
- MDN: X-Content-Type-Options
- Score role
- Core
- Introduced
- 2026-08-24
- Methodology version
- 2026-10-22