---
title: "Drop the old XSS header · Agent Wranglers"
url: https://agentwranglers.se/playbook/website/security/x-xss-protection
updated: 2026-10-20
licence: "All rights reserved"
---

# Drop the old XSS header

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Avoid
- Chapter: [Security](https://agentwranglers.se/playbook/website/security)
- Rule: Do not turn on `X-XSS-Protection`. The filter it controls is gone from current browsers, and in old ones it could open holes. Rely on the Content Security Policy instead.
- How: Remove the header from the server and from any security middleware defaults. If a scanner insists on the header, send `X-XSS-Protection: 0`, which turns the old filter off, as OWASP advises.
- Check: `curl -sI` shows no `X-XSS-Protection`, or shows it with the value `0`.

Example:

```nginx
# Remove any line like this
# add_header X-XSS-Protection "1; mode=block";
proxy_hide_header X-XSS-Protection;
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers website playbook: https://agentwranglers.se/playbook/website/security/x-xss-protection`.

- Previous: [Lock down risky DOM writes](https://agentwranglers.se/playbook/website/security/trusted-types)
- Next: [Set cookies safely or not at all](https://agentwranglers.se/playbook/website/security/cookie-attributes)
- [Security](https://agentwranglers.se/playbook/website/security)