Skip to content
Raptor home
Menu

Missing X-Content-Type-Options

security.missing_x_content_type_options
Priority
Note
Severity
Info

What we look for

These pages are served without the X-Content-Type-Options: nosniff header, which tells browsers to trust the file type the server declares instead of guessing.

Why it matters

Guessing can let a file uploaded as, say, an image be run as a script. It protects visitors but does not affect search results, so it costs no points.

How to fix

Add the header X-Content-Type-Options: nosniff to every response in your server, CDN or hosting settings.

Seen in a real crawl

From a crawl of Millbrook Hardware (the broken fixture), a test site from Raptor’s fixture suite.

Note

16 pages let browsers guess their file types

  • /Missing X-Content-Type-Options header
  • /goneMissing X-Content-Type-Options header
  • /missingMissing X-Content-Type-Options header
First 3 of 16 addressesPaths on http://127.0.0.1:8001raptor 0.3.0, 17 Oct 2026

Open this finding in that crawl’s report

It also fired on Kestrel Bay Digital and the js-heavy fixture.

Where you’ll see it

The id is stable, and every surface uses it, so it’s the thing to search for or hand to an agent.

Terminal
When it is one of the five findings under Fix first, raptor crawl prints the id under it.
Check: security.missing_x_content_type_options
crawl.json and the CSV
The crawl JSON names the finding by this id, and so do the CSV and raptor_query.
"check_id": "security.missing_x_content_type_options"
The HTML report
This link opens the finding in the report, and each finding shows its id.
crawl.html#finding=security.missing_x_content_type_options
MCP
raptor_findings with this check_id returns the finding in full, with a fix brief ready to paste into a task. If it didn’t fire, it says why.
raptor_findings {
  "job_id": "...",
  "check_id": "security.missing_x_content_type_options"
}