How to fix missing x content type options on Shopify

Steps for Shopify

1. Shopify's core storefront servers set most security headers automatically; however, `X-Content-Type-Options` may be absent on certain responses or custom domains.
2. The most reliable approach for Shopify is to route traffic through Cloudflare (free plan works) and add the header at the edge — see the Cloudflare instructions below.
3. If you use a Shopify app that injects a custom server-side proxy (e.g. a custom app built with Node/Express), add `res.setHeader('X-Content-Type-Options', 'nosniff')` in your middleware.
4. Verify by visiting your storefront, opening DevTools → Network → select the document → Response Headers, and checking for `x-content-type-options: nosniff`.

What is missing x content type options?

When a browser downloads a file from your store, it tries to figure out what kind of file it is. By default, some browsers will "sniff" (guess) the file type even if the server says otherwise — a behaviour attackers can exploit to make a browser run a malicious script disguised as an innocent image or text file. The `X-Content-Type-Options: nosniff` header is a one-line instruction you add to your server's HTTP responses that tells every browser: "Trust the content type I declared — don't second-guess it." It is one of the simplest, most universally supported security headers available.

Without this header, attackers who can upload or inject content into your store (e.g. through a product image or a user-generated field) may be able to trick browsers into executing that content as JavaScript, enabling cross-site scripting (XSS) attacks that steal customer sessions, harvest payment details, or deface your storefront. OWASP lists this under A05:2021 Security Misconfiguration, one of the most commonly exploited vulnerability categories. Beyond the direct security risk, automated security scanners — including those used by enterprise buyers, PCI-DSS auditors, and Google's Safe Browsing — flag the missing header, which can cost you customer trust, failed compliance checks, and potential removal from ad programmes. Adding it takes under 30 minutes and has zero negative side effects.

See the complete Missing x content type options guide for every platform and the full background.