Security Headers Checker / Headers

X-XSS-Protection: why it should be 0 or absent

X-XSS-Protection switched on the browsers' XSS auditor, which Chrome and Edge removed and Firefox never had. The auditor itself could be abused to leak data from pages. CSP is the control for cross-site scripting today.

What to send

X-XSS-Protection: 0

Send 0 or nothing. Any enabled value costs effectiveness points in our grade.

# server { } block (or a file included in every server block).
# "always" also sends the header on error and redirect responses.
add_header X-XSS-Protection "0" always;

How our grade counts it

• Effectiveness, minus 10: Deprecated or harmful headers present (2 each, capped at 10)

The full grading rules

Common mistakes

• X-XSS-Protection: 1; mode=block copied from an old checklist.

X-XSS-Protection on MDN