Checks · security

Missing X-Content-Type-Options Header

Opportunity security.missing_x_content_type_options

What it means

The response has no X-Content-Type-Options: nosniff header, so browsers may guess a content type and execute something that was not meant to be a script.

How to fix it

Send X-Content-Type-Options: nosniff on every response.

Where to find it in Truelint

Open the Issues pane on the right of the workspace and select Missing X-Content-Type-Options Header. The grid filters to every affected URL and the detail pane shows the specific finding for each. Export the list with Export → Current view, or from the API:

GET /api/v1/crawls/{handle}/issues/security.missing_x_content_type_options