Missing x content type options
Quick winAdd the `X-Content-Type-Options: nosniff` HTTP response header to every page and asset your store serves.
What it is
When a browser downloads a file from your store, it tries to figure out what kind of file it is. By default, some browsers will "sniff" (guess) the file type even if the server says otherwise — a behaviour attackers can exploit to make a browser run a malicious script disguised as an innocent image or text file. The `X-Content-Type-Options: nosniff` header is a one-line instruction you add to your server's HTTP responses that tells every browser: "Trust the content type I declared — don't second-guess it." It is one of the simplest, most universally supported security headers available.
Why it matters
Without this header, attackers who can upload or inject content into your store (e.g. through a product image or a user-generated field) may be able to trick browsers into executing that content as JavaScript, enabling cross-site scripting (XSS) attacks that steal customer sessions, harvest payment details, or deface your storefront. OWASP lists this under A05:2021 Security Misconfiguration, one of the most commonly exploited vulnerability categories. Beyond the direct security risk, automated security scanners — including those used by enterprise buyers, PCI-DSS auditors, and Google's Safe Browsing — flag the missing header, which can cost you customer trust, failed compliance checks, and potential removal from ad programmes. Adding it takes under 30 minutes and has zero negative side effects.
How to fix it
- Confirm the header is missing by opening your browser's DevTools (F12), going to the Network tab, reloading your homepage, clicking the first document request, and checking the Response Headers panel for `X-Content-Type-Options`.
- Identify where your HTTP response headers are set: your web server config (Nginx, Apache), a CDN/edge layer (Cloudflare, Fastly), your hosting platform's admin panel, or your app/framework middleware.
- Add the single header value `X-Content-Type-Options: nosniff` to ALL responses — not just HTML pages, but also CSS, JS, image, and font responses.
- Deploy the change and do a hard-reload (Ctrl+Shift+R / Cmd+Shift+R) then re-check DevTools to confirm the header appears in the response.
- Verify with a free online tool such as securityheaders.com or the OWASP Secure Headers Project test to get a full pass.
- If you use a CDN or reverse proxy in front of your origin, ensure the header is added at (or preserved through) the edge layer so every visitor receives it regardless of cache status.
Fix it on your platform
Pick your platform for the exact steps.
How to fix missing x content type options on Shopify
- Shopify's core storefront servers set most security headers automatically; however, `X-Content-Type-Options` may be absent on certain responses or custom domains.
- The most reliable approach for Shopify is to route traffic through Cloudflare (free plan works) and add the header at the edge — see the Cloudflare instructions below.
- If you use a Shopify app that injects a custom server-side proxy (e.g. a custom app built with Node/Express), add `res.setHeader('X-Content-Type-Options', 'nosniff')` in your middleware.
- Verify by visiting your storefront, opening DevTools → Network → select the document → Response Headers, and checking for `x-content-type-options: nosniff`.
How to fix missing x content type options on Shopify Plus
- Same as Shopify above. Additionally, if you run a headless storefront (Next.js, Hydrogen, etc.) on your own hosting, add the header in your server/framework config — see the Headless / Custom entry below.
- For Shopify Plus checkout extensibility, the Shopify-controlled checkout domain handles its own headers; focus your effort on your main storefront domain via Cloudflare or your hosting layer.
How to fix missing x content type options on WooCommerce
- Install the free 'Headers Security Advanced & HSTS WP' plugin (or similar: 'HTTP Headers', 'Security Headers') from the WordPress plugin directory: WP Admin → Plugins → Add New → search 'Security Headers'.
- Activate the plugin, go to its settings page, find the `X-Content-Type-Options` option, and enable/set it to `nosniff`. Save.
- Alternatively, edit your theme's `functions.php` (Appearance → Theme File Editor → functions.php) and add: `add_action('send_headers', function(){ header('X-Content-Type-Options: nosniff'); });`
- Or add the header in your `.htaccess` file (Apache host) via Hosting → File Manager → `.htaccess`: add `Header always set X-Content-Type-Options "nosniff"` inside the `<IfModule mod_headers.c>` block.
- For Nginx hosting, add `add_header X-Content-Type-Options 'nosniff' always;` inside the `server {}` block of your site config and reload Nginx.
- Verify with DevTools or securityheaders.com.
How to fix missing x content type options on WordPress.org
- Same as WooCommerce above — WordPress.org self-hosted sites use Apache or Nginx; use either the `.htaccess`/Nginx method or a security-headers plugin.
- Recommended plugin path: WP Admin → Plugins → Add New → 'HTTP Headers' by David Gwyer → Activate → Settings → HTTP Headers → add `X-Content-Type-Options` with value `nosniff`.
How to fix missing x content type options on BigCommerce
- BigCommerce's managed platform controls server-level headers; you cannot set arbitrary HTTP response headers directly from the BigCommerce admin.
- Place Cloudflare (or another CDN/WAF) in front of your BigCommerce store. In Cloudflare: Dashboard → your domain → Rules → Transform Rules → Modify Response Header → Create rule → Add header `X-Content-Type-Options` = `nosniff` → apply to all requests → Save & Deploy.
- Verify by checking DevTools → Network → Response Headers on your storefront.
How to fix missing x content type options on Wix
- Wix does not expose server-level HTTP header configuration in its standard admin.
- If you have a Wix site on a custom domain routed through Cloudflare: Dashboard → your domain → Rules → Transform Rules → Modify Response Header → add `X-Content-Type-Options: nosniff` → Save & Deploy.
- If you use Wix Velo (Dev Mode): open the Velo backend and add a `http-functions.js` entry that sets the header on any custom endpoints you control; note this does not cover Wix-rendered pages.
- For full coverage on standard Wix pages, Cloudflare is the only practical option.
How to fix missing x content type options on Wix Studio
- Same as Wix above. Wix Studio does not add direct server-header control; use Cloudflare Transform Rules in front of your custom domain for full coverage.
How to fix missing x content type options on Squarespace
- Squarespace does not allow direct HTTP response header configuration from the admin panel.
- Route your custom domain through Cloudflare: add your domain to Cloudflare (free plan), point your domain's nameservers to Cloudflare, then go to Rules → Transform Rules → Modify Response Header → Create Rule → Add header `X-Content-Type-Options` with value `nosniff` → deploy.
- Verify in browser DevTools after Cloudflare propagates (usually within minutes).
How to fix missing x content type options on Webflow
- Webflow does not provide a UI for custom HTTP response headers on its hosting.
- Use Cloudflare in front of your Webflow site: add your domain to Cloudflare, set Cloudflare as your DNS, then Rules → Transform Rules → Modify Response Header → add `X-Content-Type-Options: nosniff` → Save & Deploy.
- If you export your Webflow site and self-host it (Nginx/Apache), add the header directly to your server config as shown in the Generic HTML snippets.
How to fix missing x content type options on Adobe Commerce (Magento)
- For Nginx: edit `/etc/nginx/sites-available/your-magento-site.conf`, locate the `server {}` block, and add `add_header X-Content-Type-Options 'nosniff' always;`. Run `nginx -t` to test, then `systemctl reload nginx`.
- For Apache: open `.htaccess` in the Magento root (or your VirtualHost config) and add inside `<IfModule mod_headers.c>`: `Header always set X-Content-Type-Options "nosniff"`. Restart Apache.
- Alternatively, add the header programmatically in `app/code/YourVendor/YourModule/Plugin/ResponsePlugin.php` by creating a plugin on `Magento\Framework\App\Response\Http` that calls `$response->setHeader('X-Content-Type-Options', 'nosniff', true)` before dispatch.
- Flush Magento cache: Admin → System → Cache Management → Flush Magento Cache. Verify with DevTools.
How to fix missing x content type options on Magento Open Source
- Identical to Adobe Commerce (Magento) above — use the Nginx/Apache server config method or a custom module plugin.
How to fix missing x content type options on PrestaShop
- For Apache hosting: add `Header always set X-Content-Type-Options "nosniff"` inside `<IfModule mod_headers.c>` in your `.htaccess` or VirtualHost config.
- For Nginx hosting: add `add_header X-Content-Type-Options 'nosniff' always;` inside the `server {}` block.
- Alternatively, create or edit an override in `override/controllers/front/FrontController.php` and add `header('X-Content-Type-Options: nosniff');` in the `init()` method — but the server-config approach is preferred as it covers all assets.
- Clear PrestaShop cache: Admin → Advanced Parameters → Performance → Clear cache.
How to fix missing x content type options on Headless / Custom (I build in code)
- Next.js: in `next.config.js`, add to the `headers()` async function: `{ key: 'X-Content-Type-Options', value: 'nosniff' }` under the `headers` array for the `'/(.*)'` source pattern.
- Express.js / Node: use the `helmet` package — `app.use(helmet.noSniff())` — or manually `app.use((req, res, next) => { res.setHeader('X-Content-Type-Options', 'nosniff'); next(); })`.
- Nginx: add `add_header X-Content-Type-Options 'nosniff' always;` in the `server {}` or `location {}` block.
- Apache: add `Header always set X-Content-Type-Options "nosniff"` inside `<IfModule mod_headers.c>` in `.htaccess` or your VirtualHost.
- Verify with `curl -I https://yourdomain.com` and confirm the header appears in the response.
How to fix missing x content type options on Next.js
- Open next.config.js in your project root.
- Add or update the headers() async function to return the header for all routes: { source: '/(.*)', headers: [{ key: 'X-Content-Type-Options', value: 'nosniff' }] }
- Redeploy your Next.js app (e.g. via Vercel, which also lets you set headers in vercel.json under the 'headers' key).
- Verify the header appears on all responses in browser dev-tools.
How to fix missing x content type options on OpenCart
- For Apache: add 'Header always set X-Content-Type-Options "nosniff"' to the .htaccess file in your OpenCart root directory.
- For Nginx: add 'add_header X-Content-Type-Options nosniff always;' to your server {} block.
- Alternatively, edit OpenCart's index.php or a system startup file to add the PHP header() call: header('X-Content-Type-Options: nosniff'); — place it before any output.
- Verify in browser dev-tools after deploying.
How to fix missing x content type options on Ghost
- Ghost (self-hosted) is typically run behind Nginx: add 'add_header X-Content-Type-Options nosniff always;' inside the server {} block of your Ghost Nginx config (usually at /etc/nginx/sites-available/your-ghost-site.conf).
- Run 'sudo nginx -t' to validate the config, then 'sudo systemctl reload nginx'.
- For Ghost(Pro) hosted, the platform handles security headers — verify in dev-tools; contact Ghost support if the header is absent.
How to fix missing x content type options on Cloudflare (CDN/proxy, any platform)
- Log in to Cloudflare dashboard → select your domain.
- Go to Rules → Transform Rules → Modify Response Header.
- Click 'Create Rule', name it 'Add X-Content-Type-Options', set the action to 'Set' header name 'X-Content-Type-Options' to value 'nosniff', apply to all incoming requests (or use a wildcard path /*), and Save/Deploy.
- Verify in browser dev-tools that the header now appears on all responses.
Does your site have this issue?
Run a free SEOLZ scan to find missing x content type options — and every other issue — across your whole site in minutes.
Scan my site freeFrequently asked questions
What is Missing x content type options?
When a browser downloads a file from your store, it tries to figure out what kind of file it is. By default, some browsers will "sniff" (guess) the file type even if the server says otherwise — a behaviour attackers can exploit to make a browser run a malicious script disguised as an innocent image or text file. The `X-Content-Type-Options: nosniff` header is a one-line instruction you add to your server's HTTP responses that tells every browser: "Trust the content type I declared — don't second-guess it." It is one of the simplest, most universally supported security headers available.
Why does missing x content type options matter?
Without this header, attackers who can upload or inject content into your store (e.g. through a product image or a user-generated field) may be able to trick browsers into executing that content as JavaScript, enabling cross-site scripting (XSS) attacks that steal customer sessions, harvest payment details, or deface your storefront. OWASP lists this under A05:2021 Security Misconfiguration, one of the most commonly exploited vulnerability categories. Beyond the direct security risk, automated security scanners — including those used by enterprise buyers, PCI-DSS auditors, and Google's Safe Browsing — flag the missing header, which can cost you customer trust, failed compliance checks, and potential removal from ad programmes. Adding it takes under 30 minutes and has zero negative side effects.
How do I fix missing x content type options?
Add the `X-Content-Type-Options: nosniff` HTTP response header to every page and asset your store serves.
Authoritative references
- OWASP Top Ten — OWASP
- OWASP Cheat Sheet Series — OWASP
- Secure Headers Project — OWASP
- Website security — MDN