Explain
X-XSS-Protection (legacy)
Legacy header for old browser XSS filters. Modern browsers ignore it; CSP is the modern defense.
InfoCategory: general
What it is
This header controlled older browser XSS auditor behavior. Most modern browsers have removed/disabled the feature.
What to do instead
- Use CSP to mitigate script injection (recommended).
- Fix server-side templating and output encoding issues.
Related guides