What is it?
X-Content-Type-Options: nosniff is an HTTP response header that tells browsers not to guess a different content type from the declared Content-Type.
Why does it matter?
MIME sniffing can make a browser interpret a response differently than intended. On poorly configured responses, that can increase the impact of file upload, static asset, or content injection mistakes.
How to fix it?
Add the header to static and dynamic HTTP responses.
X-Content-Type-Options: nosniffSet accurate Content-Type headers as well. Configure both at the CDN, reverse proxy, or framework so the policy applies consistently.