X-XSS-Protection
Legacy XSS filter in older browsers. 1; mode=block enabled filter. Deprecated; use CSP instead.
ResponseSyntax
X-XSS-Protection: 0 | 1 | 1; mode=blockExample values
| Value | Explanation |
|---|---|
| 1; mode=block | Filter and block if XSS detected |
| 0 | Disable (when using CSP) |
cURL usage
curl -I https://example.com
Common mistakes
Can introduce vulnerabilities; prefer Content-Security-Policy.