HTTP Security Headers

X-XSS-Protection (deprecated)

A legacy toggle for old browsers' built-in XSS filters. Modern browsers have removed those filters — the header is deprecated and should be replaced by CSP.

What it is

Deprecated

This header controlled an XSS 'auditor' in older versions of Chrome, Safari and Internet Explorer. Those auditors have been removed from modern browsers because they themselves introduced information-leak and false-positive vulnerabilities. The header is effectively inert today.

X-XSS-Protection toggled a heuristic filter that tried to detect reflected XSS and block or sanitize the page. The heuristics were unreliable and, in mode=block form, could be abused to selectively disable parts of a page, so browser vendors dropped the feature entirely.

Historical values

0
Disables the filter. The only value worth sending today — it explicitly opts out of any residual legacy behavior.
1
Enabled the filter (sanitize).
1; mode=block
Enabled the filter and blocked rendering on detection. Historically recommended, now moot.
HTTP RESPONSE HEADER
X-XSS-Protection: 0

What to do instead

Deploy a strong Content-Security-Policy — that is the actual, standards-based XSS defense. If you send X-XSS-Protection at all, send 0 to disable the buggy legacy filter; do not rely on it for protection.

Why it matters

  • Understanding its deprecation prevents teams from relying on a control that does nothing in current browsers.
  • In some older browsers the auditor could be weaponized, so 0 (disable) was safer than 1.
  • It highlights why real XSS mitigation belongs in CSP, output encoding and framework escaping — not this header.

Common mistakes

  • Treating X-XSS-Protection: 1; mode=block as meaningful protection on a modern site — it is not.
  • Adding it to a security checklist while omitting a real CSP, giving false confidence.
  • Enabling the filter (1) in the rare older browser where it can be abused, rather than disabling it with 0.

How WebInspect checks this

  • WebInspect notes the header's presence but marks it deprecated and does not credit it as real XSS protection.
  • It recommends removing reliance on it and deploying a Content-Security-Policy instead.
  • It flags an enabled (1) value on the rare chance a legacy client is in scope.