Missing X-Content-Type-Options header

Why it matters

The X-Content-Type-Options header is absent, so browsers may MIME-sniff responses, which can enable some content-injection attacks.

What to do

Add the missing security header at the server/CDN level.

IT/Security · About 2 hours · Needs a specialist

How to fix it

1. Add the missing header at the web server, CDN, or platform configuration level (exact method depends on hosting).
2. Start with a permissive policy (e.g. CSP report-only mode) and tighten iteratively to avoid breaking functionality.
3. Re-test with a header-scanning tool after each change.