Missing X-XSS-Protection Header

Severity:

Best Practice

Summary

Invicti detected a missing X-XSS-Protection header which means that this website could be at risk of a Cross-site Scripting (XSS) attacks.

Impact

This issue is reported as additional information only. There is no direct impact arising from this issue.

Remediation

Add the X-XSS-Protection header with a value of "1; mode= block".

X-XSS-Protection: 1; mode=block

Please also be advised that in some specific cases enabling XSS filter can be abused by attackers. However, in most cases, it provides basic protection for users against XSS attacks.

Required Skills for Successful Exploitation

Actions To Take

Classifications

Vulnerability Index

You can search and find all vulnerabilities

Select Category

Select Vulnerability

Related Vulnerabilities

Misconfigured Frame

Content Security Policy (CSP) Contains Out of Scope report-uri Domain

Elgg Detected

ExtJs Identified

An Unsafe Content Security Policy (CSP) Directive in Use

Missing X-XSS-Protection Header

Vulnerability Index

Select Category

Select Vulnerability

Featured resources

Build your resistance to threats. And save hundreds of hours each month.