Description
The HTTP X-XSS-Protection response header, originally designed for Internet Explorer, Chrome, and Safari, aimed to mitigate reflected cross-site scripting (XSS) attacks. However, its effectiveness has diminished due to changes in browser behavior. Chrome has removed its XSS Auditor, Firefox does not and will not implement X-XSS-Protection, and Edge has retired its XSS filter. As a result, it is no longer recommended to rely solely on this header for XSS protection.
Recommendation
To enhance XSS protection, it is recommended not to send the X-XSS-Protection header or explicitly set its value to 0. Instead, use a modern Content Security Policy (CSP) without allowing unsafe-inline scripts, which provides more robust protection against XSS attacks.
References
Could your website be exposed too?
SmartScanner can check your website for X-XSS-Protection Header is Set and gives you actionable findings to investigate.
Start a free scanRelated Issues
- X-XSS-Protection Header is Missing - Vulnerability
- Content-Security-Policy Header is Missing - Vulnerability
- Public-Key-Pins Header is Set - Vulnerability
- X-Frame-Options Header is Missing - Vulnerability
