Missing X-XSS-Protection Header

Severity: Best Practice

Summary#

Invicti detected a missing X-XSS-Protection header which means that this website could be at risk of a Cross-site Scripting (XSS) attacks.

Impact#

This issue is reported as additional information only. There is no direct impact arising from this issue.

Remediation#

Add the X-XSS-Protection header with a value of "1; mode= block".

```
X-XSS-Protection: 1; mode=block
```

Please also be advised that in some specific cases enabling XSS filter can be abused by attackers. However, in most cases, it provides basic protection for users against XSS attacks.

Classifications#

ISO27001-A.14.2.5, HIPAA-164.308(a), WASC-15, CWE-16

Invicti Security Insights

What is a cross-site scripting vulnerability?
What is Reflected XSS and How to Prevent It
Real-Life Vulnerabilities Reported by Invicti
XSS Filter Evasion
Goodbye XSS Auditor