How to fix missing x content type options on Webflow
Add the `X-Content-Type-Options: nosniff` HTTP response header to every page and asset your store serves.
Steps for Webflow
- Webflow does not provide a UI for custom HTTP response headers on its hosting.
- Use Cloudflare in front of your Webflow site: add your domain to Cloudflare, set Cloudflare as your DNS, then Rules → Transform Rules → Modify Response Header → add `X-Content-Type-Options: nosniff` → Save & Deploy.
- If you export your Webflow site and self-host it (Nginx/Apache), add the header directly to your server config as shown in the Generic HTML snippets.
What is missing x content type options?
When a browser downloads a file from your store, it tries to figure out what kind of file it is. By default, some browsers will "sniff" (guess) the file type even if the server says otherwise — a behaviour attackers can exploit to make a browser run a malicious script disguised as an innocent image or text file. The `X-Content-Type-Options: nosniff` header is a one-line instruction you add to your server's HTTP responses that tells every browser: "Trust the content type I declared — don't second-guess it." It is one of the simplest, most universally supported security headers available.
Without this header, attackers who can upload or inject content into your store (e.g. through a product image or a user-generated field) may be able to trick browsers into executing that content as JavaScript, enabling cross-site scripting (XSS) attacks that steal customer sessions, harvest payment details, or deface your storefront. OWASP lists this under A05:2021 Security Misconfiguration, one of the most commonly exploited vulnerability categories. Beyond the direct security risk, automated security scanners — including those used by enterprise buyers, PCI-DSS auditors, and Google's Safe Browsing — flag the missing header, which can cost you customer trust, failed compliance checks, and potential removal from ad programmes. Adding it takes under 30 minutes and has zero negative side effects.
See the complete Missing x content type options guide for every platform and the full background.
Not sure if your Webflow store has this?
Run a free SEOLZ scan — we’ll find missing x content type options and every other issue across your whole site.
Scan my site free