How to fix missing x content type options on WooCommerce

Steps for WooCommerce

1. Install the free 'Headers Security Advanced & HSTS WP' plugin (or similar: 'HTTP Headers', 'Security Headers') from the WordPress plugin directory: WP Admin → Plugins → Add New → search 'Security Headers'.
2. Activate the plugin, go to its settings page, find the `X-Content-Type-Options` option, and enable/set it to `nosniff`. Save.
3. Alternatively, edit your theme's `functions.php` (Appearance → Theme File Editor → functions.php) and add: `add_action('send_headers', function(){ header('X-Content-Type-Options: nosniff'); });`
4. Or add the header in your `.htaccess` file (Apache host) via Hosting → File Manager → `.htaccess`: add `Header always set X-Content-Type-Options "nosniff"` inside the `<IfModule mod_headers.c>` block.
5. For Nginx hosting, add `add_header X-Content-Type-Options 'nosniff' always;` inside the `server {}` block of your site config and reload Nginx.
6. Verify with DevTools or securityheaders.com.

What is missing x content type options?

When a browser downloads a file from your store, it tries to figure out what kind of file it is. By default, some browsers will "sniff" (guess) the file type even if the server says otherwise — a behaviour attackers can exploit to make a browser run a malicious script disguised as an innocent image or text file. The `X-Content-Type-Options: nosniff` header is a one-line instruction you add to your server's HTTP responses that tells every browser: "Trust the content type I declared — don't second-guess it." It is one of the simplest, most universally supported security headers available.

Without this header, attackers who can upload or inject content into your store (e.g. through a product image or a user-generated field) may be able to trick browsers into executing that content as JavaScript, enabling cross-site scripting (XSS) attacks that steal customer sessions, harvest payment details, or deface your storefront. OWASP lists this under A05:2021 Security Misconfiguration, one of the most commonly exploited vulnerability categories. Beyond the direct security risk, automated security scanners — including those used by enterprise buyers, PCI-DSS auditors, and Google's Safe Browsing — flag the missing header, which can cost you customer trust, failed compliance checks, and potential removal from ad programmes. Adding it takes under 30 minutes and has zero negative side effects.

See the complete Missing x content type options guide for every platform and the full background.