X-XSS-Protection (deprecated)

Recommended value

X-XSS-Protection: 0

How to set X-XSS-Protection

# inside your server { } block
add_header X-XSS-Protection "0" always;

# .htaccess or virtual host (needs mod_headers)
Header always set X-XSS-Protection "0"

// app/Http/Middleware/SecurityHeaders.php
public function handle(Request $request, Closure $next): Response
{
    $response = $next($request);
    $response->headers->set('X-XSS-Protection', '0');

    return $response;
}

// bootstrap/app.php
->withMiddleware(function (Middleware $middleware) {
    $middleware->append(\App\Http\Middleware\SecurityHeaders::class);
})

app.use((req, res, next) => {
  res.setHeader('X-XSS-Protection', '0');
  next();
});

// or: app.use(require('helmet')()) for a sensible default set

Rules → Transform Rules → Modify Response Header → Create rule.
Match: all incoming requests (or your hostname).
Then: Set static → Header name: X-XSS-Protection → Value: 0

In nginx, an add_header inside a location block discards every add_header inherited from the server block. Repeat your security headers there, or use an include file. The always flag also sends the header on error responses.

Common mistakes

• ✕ Treating X-XSS-Protection: 1; mode=block as XSS protection. It protects nothing in current browsers.
• ✕ Skipping a Content-Security-Policy because this header is "already set".

FAQ