en
/login
Koval SEO

Audited HTML pages lack nosniff

In the reportResponses without X-Content-Type-Options: nosniff

x_content_type_options_missing · Issue

Short answer

This appears when a page answered twice in a row without X-Content-Type-Options: nosniff. The header tells browsers to trust the declared file type instead of guessing it, which blocks attacks where an uploaded file is run as a script. Send X-Content-Type-Options: nosniff on your responses.

Severity: Low. One header line fixes it, and it matters most where visitors can upload files.

Why it matters

web.dev's security headers reference explains that without nosniff, some browsers may treat a file, such as an uploaded image, as an active document and run its scripts, and recommends the header for all of your resources.

What to do

  1. Look at the finding: it shows both responses we read and the X-Content-Type-Options value in each, or that it was absent.
  2. Add X-Content-Type-Options: nosniff at your server or CDN, for every response and not only pages.
  3. Make sure nosniff is the header's first value; the check reads the first one.

What we read

We read each crawled page's final response with our own user agent. When the first answer is a complete HTML page with 200, we request the same address a second time straight away, with the same request, and read the headers of both answers. Every such page is read, including pages with noindex.

A page is reported when, in both answers, the first X-Content-Type-Options header is missing or its first value is not nosniff, in any letter case. If the two answers disagree about the nosniff result, or the second request cannot be compared with the first, for example because the first answer set a cookie or more than 30 seconds passed, the page is marked as not checked.

Example & evidence

Illustrative example — one page read twice, not a live audit.

https://bakery.example/ answered both requests with:

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
X-Frame-Options: SAMEORIGIN

Neither answer has X-Content-Type-Options, so the page is reported with both responses.

A possible correction: add X-Content-Type-Options: nosniff to every response.

Confirm & check again

Check for yourself: open the page's response headers in your browser's developer tools and look for X-Content-Type-Options: nosniff.

Check again: Full audit — run a new audit of the site. The finding closes when the page is crawled again and both answers are complete and agree that they carry nosniff. If they disagree about nosniff, for example while the header reaches only some of your servers, the page is not checked and the finding stays open; a page not crawled again, or answering 404, keeps it open too.

Limits & sources

The check reads HTML page responses only, not the files where guessing matters most, and only the first header and its first value. It does not observe what a browser does.

Confidence: High because two answers in a row are read directly and must agree.

Sources

  • web.dev, Security headers quick reference — explains that without nosniff some browsers may treat an uploaded file as an active document and run its scripts, and recommends the header for all resources. Checked 28 September 2026.

Editorial review: 29 September 2026