Checks

X-Content-Type-Options is present

The response includes X-Content-Type-Options.

Why it matters

nosniff stops browsers from guessing a content type that could execute a download as script or style.

What to do

The value should be nosniff.

Reference

Security response headers reduce XSS, clickjacking, and protocol downgrade risk.

OWASP Secure Headers Project