Check · Security header
No nosniff header
What it means
Without X-Content-Type-Options: nosniff, browsers may guess content types and execute files that were never meant to be scripts.
Why it matters
MIME-sniffing turns harmless uploads into an XSS vector.
How to fix it
Send X-Content-Type-Options: nosniff on every response — one line of hosting config.
Does your app have this problem? The free passive check tests this and 4 more areas — no login, nothing touched.
Check your app free