Does your site stop browsers from guessing file types?

The file type check looks for the X-Content-Type-Options header set to nosniff on your responses. It tells browsers to trust the file type your server declares instead of guessing from the content.

What does this check look at?

It looks at whether responses tell browsers not to guess a file type. MDN says the header indicates that the declared types should be respected and not changed. Lockpick's own guide puts it this way. Content type protection stops the browser from guessing what a file is, which could turn an uploaded image into a script.

Pulse and Deep scans both run it.

What does a result mean?

A missing setting is a hardening gap, not proof that any file can be run as a script. A clean result means nothing was found in what the scan read. It does not prove the problem is absent from parts the scan never sees.

How serious is a finding?

Treat this as a hardening gap. It makes an attacker’s job easier but gives them no path of its own, so fix it after anything more direct. Confidence starts low, because it is inferred from headers or declarations rather than shown directly. The report lists what to fix by how directly someone could use it, not by the severity label.

What does a confirmed finding have to show?

Which standards does it relate to?

Each one is a related control, not a verification. A scan sees what anyone online can see, so it never proves a whole requirement is met.

Fix it with your AI

This is one header, safe to add almost everywhere, as long as your files declare the right type.

Add the response header X-Content-Type-Options: nosniff to every response my site serves, including pages, scripts, styles and API responses. Set it once in my host or framework config. Then check that my scripts, stylesheets and fonts still load, since browsers will now refuse a script served with the wrong Content-Type.

How to check

Say Atlas, our example app at atlas.example, sets nosniff on pages but not on uploaded files. The check names the response that lacked it.

The free quick check covers this on your homepage with no account, and a Pulse scan from your account adds your scripts and public records. Pulse or Deep explains the difference.