Security & HTTPS

The nosniff security header is not sent

One of the 136 checks Lala SEO runs on every page of a site in a free audit.

How serious: Worth knowing. Small, or only matters in some cases. Read it and decide.
Score: Reported, but it does not lower your site's score.
Based on: Industry standard: Google does not document this one, so the check follows established practice.

What is wrong

Your website is not sending an HTTP header called `X-Content-Type-Options: nosniff`. This header tells browsers to trust the content type your server declares and not to guess at it. Without it, a browser might interpret a file as something different from what you intended—for example, treating a text file as executable code.

Why it costs you

If a browser misinterprets a file type, it can execute malicious code that an attacker has hidden on your site. This is most dangerous if someone uploads or injects a file that looks like one type but is actually another. A visitor could end up downloading malware or having their browser compromised without your knowledge.

How to fix it

Add the header `X-Content-Type-Options: nosniff` to all HTTP responses from your server. If you use Apache, add `Header always set X-Content-Type-Options "nosniff"` to your `.htaccess` file or virtual host configuration. If you use Nginx, add `add_header X-Content-Type-Options "nosniff" always;` to your server block. If your site runs on a platform like WordPress or a managed host, check your security settings or contact support—many now include this header by default.

What the audit tests

The start page's response sends X-Content-Type-Options: nosniff

Check your site

Run a free audit of up to 300 pages. No card needed.

Start a free audit

Or check a single address with the free tool.

Other security & https checks

All 136 checks