Deprecated X-XSS-Protection Header

What this finding means

Unlike the other findings in this cluster, this one is flagged when the header is present. X-XSS-Protection controlled a browser-side reflected-XSS filter that has been removed from every current major browser engine (Chrome, Edge and Safari have all dropped support; Firefox never implemented it). Sending the header today has no effect on modern browsers, and on some older browser versions it was itself a source of bugs, including cases where the filter could be abused to suppress legitimate page content.

Why it matters

This is a low-severity, cleanup-level finding rather than an active vulnerability. The header itself doesn't create a security hole on modern browsers — it simply does nothing. It's worth removing because a deprecated security header sitting in your config can create false confidence ("we have XSS protection headers") when the actual defense against XSS is a properly configured Content-Security-Policy, which current browsers do enforce.

What Nivaronix checks

Nivaronix's security headers checker checks whether X-XSS-Protection is present in your response headers and flags it as deprecated if so. This is a configuration check, not a vulnerability scan or exploit attempt.

Evidence example

Example only, for illustration — not evidence from a live scan of any specific site.

X-XSS-Protection: 1; mode=block

How to fix it

Remove the header from your server or CDN configuration rather than trying to set a "better" value — there is no configuration of this header that current browsers act on.

# Simply delete the add_header X-XSS-Protection ... line.

# Remove the Header always set X-XSS-Protection ... directive, or unset it explicitly:
Header unset X-XSS-Protection

Rules → Transform Rules → Modify Response Header → remove the X-XSS-Protection rule if one was added at the edge.

Verify the fix

Re-run a scan, or check with curl -sI https://your-domain.example, and confirm the X-XSS-Protection header no longer appears in the response.

Standards reference

See the methodology page for exactly how this finding is scored.