X-XSS-Protection header invalid

OWASP 2013-A5 OWASP 2017-A6 WASC-15 CWE-16

The X-XSS-Protection response header is one of the major features of almost all famous web browsers to stop cross-site scripting. It stops the pages from loading when they detect reflected cross-site scripting attacks. This application does not have a recognising X-XSS-Protection header. This application is at risk due to its vulnerability to Cross-site Scripting attacks. The value of X-XSS-Protection header only is zero or one.

    X-XSS-Protection: 0                              # Disable XSS filtering
    X-XSS-Protection: 1                              # Enables filtering. If cross site scripting detected - the browser will sanitise
    X-XSS-Protection: 1; mode=block                  # Under this mode, when cross site scripting detected - the browser wont render the page
    X-XSS-Protection: 1; report=<reporting-uri>        # Enables filtering, when detected - the browser will sanitise and report the violation



    X-XSS-Protection: 1; mode=block



The major impact for this violation is cross-scripting attacks.

Mitigation / Precaution

Beagle recommends changing the X-XSS-Protection value to 0 or 1.


    header("X-XSS-Protection: 1; mode=block");


Apache (.htaccess)

    <IfModule mod_headers.c>
      Header set X-XSS-Protection "1; mode=block"



    add_header "X-XSS-Protection" "1; mode=block";


Latest Articles