What does the X-Content-Type-Options header do?
Browsers sometimes guess what kind of file they have received, and a guess can be exploited: a file uploaded as an image could be run as a script. The X-Content-Type-Options header, set to "nosniff", tells the browser to trust the type the server declared and never guess. It is a single line of configuration with no visible effect on a working site, which is exactly why it is so often missing.
Why it matters
Any site that lets people upload files, including a contact form with an attachment, a comment system or a client area, can end up hosting a file that looks like one thing and behaves as another. Content sniffing lets a browser decide that a text file is really HTML, or that an image is really JavaScript, and run it in the context of your site. With nosniff, the browser does what the server says and refuses to run a file whose declared type does not match its use.
How to check
Our check looks for the header on your home page. It is also one of the headers reported by free tools such as securityheaders.com.
How to fix it
Add the header "X-Content-Type-Options: nosniff" to every response. On Apache it is one line in the .htaccess file, on Nginx one line in the server block, and most hosting panels, content delivery networks and WordPress security plugins have a setting for it. It is safe to switch on for any site: the only thing it stops is browsers second-guessing your server, which a correctly configured server never needs.
Not sure how your own site does on this? Run the free check: it takes about twenty seconds and reports on this and thirty other things.