Missing X-XSS-Protection Header

Severity: Best Practice
Summary#

Invicti detected a missing X-XSS-Protection header which means that this website could be at risk of a Cross-site Scripting (XSS) attacks.

Impact#
This issue is reported as additional information only. There is no direct impact arising from this issue.
Remediation#
Add the X-XSS-Protection header with a value of "1; mode= block".
  • X-XSS-Protection: 1; mode=block

Please also be advised that in some specific cases enabling XSS filter can be abused by attackers. However, in most cases, it provides basic protection for users against XSS attacks.

Build your resistance to threats. And save hundreds of hours each month.

Get a demo See how it works