How to add the X-Content-Type-Options header in Netlify

This header stops browsers from guessing (sniffing) a file's type and makes them respect the Content-Type you send.

Netlify configuration (_headers file)

/*
  X-Content-Type-Options: nosniff

Put the _headers file in your publish directory, or use a [[headers]] block in netlify.toml, then redeploy.

Make sure your server sends correct Content-Type headers, or some files may stop loading.

curl -sI https://your-site.com | grep -i x-content-type-options

Or run a free Korrali Web scan to check this and every other security header at once.