X-XSS-Protection response header is a feature of Internet Explorer, Chrome and Safari that stops pages from loading when they detect reflected cross-site scripting (XSS) attacks. Although these protections are largely unnecessary in modern browsers when sites implement a strong
'unsafe-inline'), they can still provide protections for users of older web browsers that don't yet support CSP.
- Chrome has removed their XSS Auditor
- Firefox has not, and will not implement
- Edge has retired their XSS filter
This means that if you do not need to support legacy browsers, it is recommended that you use
Content-Security-Policy without allowing
unsafe-inline scripts instead.
|Header type||Response header|
|Forbidden header name||no|
X-XSS-Protection: 0 X-XSS-Protection: 1 X-XSS-Protection: 1; mode=block X-XSS-Protection: 1; report=<reporting-uri>
Disables XSS filtering.
Enables XSS filtering (usually default in browsers). If a cross-site scripting attack is detected, the browser will sanitize the page (remove the unsafe parts).
- 1; mode=block
Enables XSS filtering. Rather than sanitizing the page, the browser will prevent rendering of the page if an attack is detected.
- 1; report=<reporting-URI> (Chromium only)
Enables XSS filtering. If a cross-site scripting attack is detected, the browser will sanitize the page and report the violation. This uses the functionality of the CSP
report-uridirective to send a report.
Block pages from loading when they detect reflected XSS attacks:
X-XSS-Protection: 1; mode=block
header("X-XSS-Protection: 1; mode=block");
<IfModule mod_headers.c> Header set X-XSS-Protection "1; mode=block" </IfModule>
add_header "X-XSS-Protection" "1; mode=block";
Not part of any specifications or drafts.
BCD tables only load in the browser