topic
Verified 2026-09-18

X-XSS-Protection

A legacy browser filter header for reflected cross-site scripting.

Do not rely on X-XSS-Protection; modern applications should use a correctly configured CSP and generally send X-XSS-Protection: 0 or omit the header.

httpsecuritydeprecatedheader

Reference (http)

X-XSS-Protection: 0

Do not rely on X-XSS-Protection; modern applications should use a correctly configured CSP and generally send X-XSS-Protection: 0 or omit the header.

Common mistakes

  • Enabling the legacy filter in a way that changes or breaks otherwise safe content.

Sources

Permalink: https://merginit.com/reference/http/x-xss-protection