X-Content-Type-Options: nosniff, what it blocks (tested in Chrome)
nosniff tells the browser to trust the Content-Type header instead of guessing. For scripts that means a wrong type stops the script from running.
1. What we measured
A page loaded the same one-line script with <script src>:
| Content-Type | Without nosniff | With nosniff |
|---|---|---|
text/javascript | Ran | Ran |
text/plain | Ran | Blocked |
| (none) | Ran | Blocked |
Chrome's console showed: Refused to execute script from '…' because its MIME type ('text/plain') is not executable, and strict MIME type checking is enabled. If you see that error after adding the header, the fix is the server's Content-Type for that file, not removing nosniff.
2. Why it matters
Without nosniff, a file that users upload as "text" (or any response with the wrong type) can still be run as a script if another page includes it. nosniff closes that gap. It costs nothing when your server sends correct types, which our test confirms: text/javascript with nosniff ran normally.
3. Adding it
# nginx (server block; 'always' also covers error pages)
add_header X-Content-Type-Options nosniff always;
# Apache (mod_headers)
Header always set X-Content-Type-Options "nosniff"In nginx, a nested location that has its own add_header lines drops this one. We measured the same trap with HSTS in Strict-Transport-Security not set in nginx. Check with curl -sI https://your-site/ | grep -i x-content-type, and build the full set with the free security headers generator.
Frequently asked questions
What does X-Content-Type-Options: nosniff mean?
Don't guess the file type; use the Content-Type header. In our Chrome test, scripts served as text/plain or without a type were blocked with nosniff and ran without it.
Can nosniff break my site?
Only where files are served with the wrong Content-Type. Chrome logs 'Refused to execute script … strict MIME type checking is enabled'. Fix the type on the server.
Is nosniff the only valid value?
Yes. nosniff is the only value the header has.
Written with AI assistance. Measured on 2026-10-01 in Chromium 153: a page loaded the same script from a local server with different Content-Type and X-Content-Type-Options headers. The nginx/Apache lines were not run in this test. PlainHeaders is our extension; the other methods are free.