How to fix missing x content type options on Headless / Custom (I build in code)

Steps for Headless / Custom (I build in code)

1. Next.js: in `next.config.js`, add to the `headers()` async function: `{ key: 'X-Content-Type-Options', value: 'nosniff' }` under the `headers` array for the `'/(.*)'` source pattern.
2. Express.js / Node: use the `helmet` package — `app.use(helmet.noSniff())` — or manually `app.use((req, res, next) => { res.setHeader('X-Content-Type-Options', 'nosniff'); next(); })`.
3. Nginx: add `add_header X-Content-Type-Options 'nosniff' always;` in the `server {}` or `location {}` block.
4. Apache: add `Header always set X-Content-Type-Options "nosniff"` inside `<IfModule mod_headers.c>` in `.htaccess` or your VirtualHost.
5. Verify with `curl -I https://yourdomain.com` and confirm the header appears in the response.

What is missing x content type options?

When a browser downloads a file from your store, it tries to figure out what kind of file it is. By default, some browsers will "sniff" (guess) the file type even if the server says otherwise — a behaviour attackers can exploit to make a browser run a malicious script disguised as an innocent image or text file. The `X-Content-Type-Options: nosniff` header is a one-line instruction you add to your server's HTTP responses that tells every browser: "Trust the content type I declared — don't second-guess it." It is one of the simplest, most universally supported security headers available.

Without this header, attackers who can upload or inject content into your store (e.g. through a product image or a user-generated field) may be able to trick browsers into executing that content as JavaScript, enabling cross-site scripting (XSS) attacks that steal customer sessions, harvest payment details, or deface your storefront. OWASP lists this under A05:2021 Security Misconfiguration, one of the most commonly exploited vulnerability categories. Beyond the direct security risk, automated security scanners — including those used by enterprise buyers, PCI-DSS auditors, and Google's Safe Browsing — flag the missing header, which can cost you customer trust, failed compliance checks, and potential removal from ad programmes. Adding it takes under 30 minutes and has zero negative side effects.

See the complete Missing x content type options guide for every platform and the full background.