Missing Security Headers Example: X-Content-Type-Options
I left the Oczakov gate wide open, and the portcullis that fell on my horse was the only security the place ever showed.
The short answer
- What it is
- This issue means a 200 HTML page lacks Content-Security-Policy, X-Content-Type-Options: nosniff, or frame protection. It also covers a Referrer-Policy that ends in an unsafe value.
- Why it matters
- These headers limit the damage from script injection, clickjacking, and file type confusion. A hacked site can be flagged in search results, so prevention protects traffic as well as visitors.
- How a crawler should report it
- Report each header as present, missing, or unsafe on the page URL, and show the exact value. Accept CSP frame-ancestors or X-Frame-Options as frame protection.
- Live examples
/lab/security-headers/(positive)/lab/security-headers/near-miss/(near miss)
Response Headers That Protect Visitors From Common Attacks
X-Content-Type-Options is a response header with one valid value, nosniff. It tells the browser to trust the declared content type and not to guess. Guessing is risky, since a file uploaded as text could then run as a script. This header and its relatives go missing because web servers do not add them by default. A hosting move or CDN change can also drop them with no visible sign.
Each header has a separate job. Content-Security-Policy limits where scripts and other resources may load from. Its frame-ancestors directive controls who can embed the page, and X-Frame-Options is the older way to do that. Referrer-Policy controls how much of a URL is shared with other sites. Values like unsafe-url send the full address, even from HTTPS to HTTP. Pages render normally without these headers, so a visitor will not see the gap.
Google has not listed these headers as ranking signals, so do not expect them to lift a page by themselves. Their value is protection. To detect them, request the HTML with curl -I URL and read the response. Test the final URL after any redirects. Check more than the home page, because an app and a marketing site on one domain may send different headers. Only a successful HTML response needs this check.
Start with the easy headers. Add X-Content-Type-Options: nosniff and Referrer-Policy: strict-origin-when-cross-origin at the server or CDN. Add frame-ancestors 'self' if nobody else should embed your pages. A full content security policy takes more care, because it can block your own scripts. Roll it out with Content-Security-Policy-Report-Only first, read the reports, and enforce it once the list of allowed sources is complete.