Agent Wranglers

Security Avoid

Drop the old XSS header

Do not send X-XSS-Protection. It is obsolete and can open holes. Rely on the Content Security Policy instead.

By Erik Bergstedt, Agent Wranglers. Updated .

How to do it

Remove the header from the server and from any security middleware defaults.

Example

# Remove any line like this
# add_header X-XSS-Protection "1; mode=block";
proxy_hide_header X-XSS-Protection;

How to check

curl -sI does not show it.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers website playbook: https://agentwranglers.se/playbook/website/security/x-xss-protection.