Checks

Missing X-Content-Type-Options

The response did not include X-Content-Type-Options.

Why it matters

Without nosniff, some browsers may MIME-sniff a response into an executable type.

What to do

Set X-Content-Type-Options: nosniff.

Reference

Security response headers reduce XSS, clickjacking, and protocol downgrade risk.

OWASP Secure Headers Project