How to fix missing x content type options on WooCommerce

Steps for WooCommerce

1. Install the free 'HTTP Headers' plugin (by David Gwyer) or 'Security Headers' plugin from the WordPress plugin directory: WP Admin → Plugins → Add New → search 'HTTP Headers' or 'Security Headers'.
2. After activating, go to Settings → HTTP Headers (or the plugin's own menu item) and add a new header: Name = X-Content-Type-Options, Value = nosniff. Save.
3. Alternatively, edit your theme's functions.php (Appearance → Theme File Editor → functions.php) and add: add_action('send_headers', function(){ header('X-Content-Type-Options: nosniff'); });
4. Or add 'Header always set X-Content-Type-Options "nosniff"' to your .htaccess file (Apache) or 'add_header X-Content-Type-Options nosniff always;' to your nginx server block — both found in your hosting control panel's file manager or via FTP.
5. Verify by reloading any page and checking Response Headers in browser dev-tools.

X-Content-Type-Options: nosniff

What is missing x content type options?

When your web server sends a file to a visitor's browser, it labels that file with a "content type" (e.g. "this is a CSS stylesheet" or "this is a JPEG image"). The `X-Content-Type-Options: nosniff` header is a one-line instruction you add to your server's responses that tells browsers: "Trust the label I gave this file — do not try to re-examine and re-classify it yourself." Without this header, some browsers will "sniff" (inspect the raw bytes of) a file and decide for themselves what kind of file it is, which can be exploited by attackers to trick a browser into treating a malicious upload as a runnable script.

Without this header, an attacker who can upload content to your store (e.g. a product image or a review attachment) may be able to craft a file that a browser silently re-interprets as executable JavaScript, enabling a MIME-type confusion attack or a cross-site scripting (XSS) exploit — potentially stealing customer credentials or payment data. This is classified under OWASP A05:2021 Security Misconfiguration, one of the most common and impactful vulnerability categories. Modern security scanners, browser dev-tools audits, and PCI DSS compliance checks all flag this missing header, so it can block you from passing security reviews required by payment processors. It is one of the fastest, lowest-risk security wins available: a single line of configuration that all modern browsers honour.

See the complete Missing x content type options guide for every platform and the full background.