NOSNIFF-MISSING
Browsers may guess content types
What it means
Without X-Content-Type-Options: nosniff, a browser may treat an uploaded file as a script if its content looks like one.
How to fix it
- 1Add the header X-Content-Type-Options: nosniff to every response. It has no downside.
Re-check after the change
DNS changes can take up to the record's TTL to be seen; use Re-run on the result page to bypass our 10-minute cache.