HTTP headers / response header
X-Content-Type-Options
X-Content-Type-Options: nosniff
What it does
Forbids browsers from MIME-sniffing the body into a different type than Content-Type declares — blocks a class of XSS via mislabeled uploads.
The gotcha
There is exactly one valid value (nosniff); set it everywhere, there is no downside.
Debugging headers on a phone
The fastest way to see what X-Content-Type-Options is actually doing is to send the request and read both sides raw — ReqPad shows auto-generated and custom headers for every request, on all six protocols, with history. Related references: status codes · WWW-Authenticate · Content-Encoding · Transfer-Encoding · ETag · Last-Modified · Expires
Inspect X-Content-Type-Options on a live request.
Build the request, send it, read raw headers and timing — from your iPhone. Free to start.