Audit rules

X-Content-Type-Options Missing

The response has no "X-Content-Type-Options: nosniff" header, so browsers may guess the type of a response instead of using the declared one. In a QuikSEO audit, a failure of this rule has info severity and counts against the score. Below are the exact condition, its exceptions and the sources behind it, followed by the other rules of the same group.

01 — Definition

How This Rule Is Checked

The rule is a pure function of the fetched page: no extra requests, no account settings. The same input always gives the same result.

Rule Severity and Score

Rule id: security.content_type_options
Group: Security
Severity of a failure: Info
Counts in the score: Yes, whenever it applies to the page
Required for a score: No

Condition and Exceptions

Condition: No X-Content-Type-Options: nosniff → fail (info)
Exceptions: HTML mode → not_checked

Sources and Project Decision

Sources: Fetch Standard, section 3.6: X-Content-Type-Options header (WHATWG, Q08)
Project decision: Info (lot 2): a hardening header, not a search requirement.

02 — Security

Other Rules in This Group

The other checks of the same group, each with its own condition and sources.

Content Security Policy Missingsecurity.csp
Framing Protection Missingsecurity.frame_protection
HSTS Missingsecurity.hsts
Permissions Policy Missingsecurity.permissions_policy
Referrer Policy Missingsecurity.referrer_policy
Flagged by Safe Browsingsecurity.safe_browsing
Form Submits Over HTTPsecurity.unsafe_forms