What MIME sniffing is and why nosniff matters
Every response a server sends carries a Content-Type header that names the kind of data inside, such as text/html or image/png. Browsers do not always trust that label. When the type looks wrong or missing they fall back to MIME sniffing, which means they inspect the bytes and guess the type for themselves. That guess is convenient for old or misconfigured sites, but it is also a security hole. If an attacker can get content they control onto your origin, a browser that sniffs might decide a plain file is really a script and run it, which opens the door to cross site scripting and drive by attacks.
The X-Content-Type-Options header shuts that behavior down. It accepts one value, nosniff, and that value tells the browser to honor the declared Content-Type and never second guess it. With nosniff in place a response labeled as text stays text and a response labeled as an image stays an image, so attacker supplied content cannot be reinterpreted as executable code.
How to add the header
Sending the header is a one line change on most stacks. On Apache add Header set X-Content-Type-Options "nosniff" to your config or .htaccess. On Nginx add add_header X-Content-Type-Options "nosniff" always; inside the server or location block. In a Node and Express app you can write res.setHeader("X-Content-Type-Options", "nosniff"), or let Helmet set it for you with its default configuration. After you deploy the change, rerun this checker to confirm the live response now returns nosniff. To see this header alongside the rest of your defenses, read the X-Content-Type-Options guide.