ERT-CONFIG-004
Missing X-Content-Type-Options
LowA02:2025CWE-693
Why it matters
Security headers, TLS, email spoofing, takeovers. This check looks specifically for: missing x-content-type-options.
How to fix it
Send X-Content-Type-Options: nosniff.
How we test it
Passive — runs in the free check, looks only at what a browser can see.