X-XSS-Protection

A legacy header that should now be disabled or removed. Enabling it is worse than leaving it off.

Recommended value

What it does

This controlled a built-in XSS auditor in older browsers. Every major engine has removed that auditor, because it was bypassable and introduced vulnerabilities of its own — the filter could be tricked into disabling legitimate script, and its behaviour leaked information across origins.

Modern guidance is X-XSS-Protection: 0, or removing the header. Guides recommending 1; mode=block are years out of date.

It is not a substitute for CSP and never was.

Sites sending this header

Found while scanning 188 well-known sites on 2026-08-04:

Check a site