How to add the X-Content-Type-Options header in Apache

This header stops browsers from guessing (sniffing) a file's type and makes them respect the Content-Type you send.

Apache configuration (.htaccess or virtual host)

<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
</IfModule>

Requires mod_headers (a2enmod headers on Debian/Ubuntu). Reload Apache after editing the virtual host.

Make sure your server sends correct Content-Type headers, or some files may stop loading.

curl -sI https://your-site.com | grep -i x-content-type-options

Or run a free Korrali Web scan to check this and every other security header at once.