Missing X-Content-Type-Options header

What it is

Without X-Content-Type-Options: nosniff, some browsers may try to guess a file's type instead of trusting what the server declares — that guessing is exactly how an uploaded file disguised as an image can end up executed as script in older browsers.

How to fix it

Add the X-Content-Type-Options: nosniff header. If you're not sure how, install the WordPress Plugin: its Security tab applies fixes like this one automatically.