Skip to content
RU Sign In
RU
← All HTTP Headers
Security

X-XSS-Protection

Legacy header that enabled the browser's built-in XSS filter. Now deprecated in favor of Content-Security-Policy.

Syntax

X-XSS-Protection: 0 | 1 | 1; mode=block

Example

X-XSS-Protection: 0

Description

X-XSS-Protection enabled the XSS filter in older browsers. Values: 0 (disable), 1 (enable), 1; mode=block (block page on detection).

Recommended modern value is 0 — the filter itself can introduce vulnerabilities.

Deprecated. Modern browsers removed the XSS auditor. Use Content-Security-Policy instead.

How real sites send this header

Home-page responses of 503 popular sites from the enterno.io /check catalogue, checked in the last 30 days.

29.2% (147 of 503) send X-XSS-Protection.

Most common values:

  • 1; mode=block — 107 sites
  • 0 — 26 sites
  • 1 — 9 sites

See it on: google.com, yandex.ru, discord.com, github.com, cloudflare.com

Check if your website sends this header correctly

Check your headers →

Related Articles

Web Server Security Hardening Checklist: Nginx and Apache
Complete web server hardening checklist for nginx and Apache. File permissions, security headers, TLS configuration, access control, and monitoring.
Security Headers: CSP, HSTS, X-Frame-Options, nosniff
Which HTTP security headers to send and how: Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, nosniff and Referrer-Policy.

Related Headers

Content-Security-Policy
Controls which resources the browser is allowed to load for a page, helping prevent XSS and data injection attacks.
Cross-Origin-Opener-Policy
Isolates the browsing context to prevent cross-origin attacks like Spectre from accessing sensitive data.
Cross-Origin-Resource-Policy
Restricts which origins can load a resource, preventing unauthorized cross-origin reads.
Permissions-Policy
Controls which browser features and APIs can be used on the page, such as camera, microphone, and geolocation.
Referrer-Policy
Controls how much referrer information is included with requests, balancing privacy with analytics needs.
Strict-Transport-Security
Instructs browsers to only access the site via HTTPS, protecting against protocol downgrade attacks and cookie hijacking.

Related guides

Longer-form reading on this topic from the knowledge base.

Automate this check

Set up continuous monitoring and get an alert when something breaks. No manual runs to remember.

Start free

Related Articles

HTTP

How to Fix 404 Not Found Errors: Visitors, nginx, Apache, CDN

19 min · Read → HTTP

HTTP Methods Explained: GET, POST, PUT, DELETE and Beyond

6 min · Read → HTTP

Server-Sent Events vs WebSockets: Which to Use for Realtime

5 min · Read →
All articles →

Start monitoring for free

Sign up and get access to API, monitoring and notifications

Create Account API Documentation