Disabled X-XSS-Protection Header
Severity:
Information
Summary
Invicti detected a disabled X-XSS-Protection header which means that this website could be at risk of a Cross-site Scripting (XSS) attacks.
Internet Explorer's built-in cross-site scripting protection can be disabled by using the following HTTP Header : X-XSS-Protection: 0
Impact
This issue is reported as additional information only. There is no direct impact arising from this issue.
Remediation
Add the X-XSS-Protection header with a value of "1; mode= block".
- X-XSS-Protection: 1; mode=block
Please also be advised that in some specific cases enabling XSS filter can be abused by attackers. However, in most cases, it provides basic protection for users against XSS attacks.
Required Skills for Successful Exploitation
Actions To Take
Classifications
Vulnerability Index
You can search and find all vulnerabilities
Select Category
Select Vulnerability
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Featured resources
Build your resistance to threats. And save hundreds of hours each month.
