The fix, in one snippet
Content-Security-Policy: script-src 'self'Illustrative values. Change the paths, hostnames and options to match your own site before using it.
The sections below explain what is tested, why it matters and the alternatives.
What we test
Scan.now reads the X-XSS-Protection header on the response to /. An absent header, or the explicit value 0, passes. The values 1 and 1; mode=block (with or without a report= parameter) are reported as informational. The check is deliberately gentle: the header no longer does anything in current browsers, so it cannot make the site less secure today, but its presence usually signals that a server template from the 2010s is still in use and that the site may be relying on a filter that was removed rather than on a Content-Security-Policy. The report says which value was seen and whether an enforced CSP exists alongside it.
Why it matters
The header controlled the reflected-XSS auditors built into Internet Explorer 8, Chrome and Safari. Those filters compared the request to the response and neutralised script that appeared in both. The approach turned out to be unfixable: an attacker could craft a request that made the filter disable a legitimate script, breaking security logic on the page, and because the filter's decision was observable, it became an oracle for cross-site information leaks (reading whether a given string was present in another site's page). Chrome removed its XSS Auditor in version 78 in 2019, Edge followed when it moved to Chromium, WebKit removed its auditor, and Firefox never shipped one. OWASP now recommends explicitly sending 0 for any legacy client that still has a filter. Real protection against XSS comes from output encoding and CSP, as explained in the XSS guide.
How to fix it
Either remove the header or set it to 0, and make sure a Content-Security-Policy is in place. nginx (remove any existing add_header X-XSS-Protection line, then optionally):
add_header X-XSS-Protection "0" always;Apache:
Header always set X-XSS-Protection "0"
# or simply
Header unset X-XSS-ProtectionExpress with Helmet has sent X-XSS-Protection: 0 by default since version 4, so a value of 1 on an Express app usually comes from a reverse proxy or CDN layer in front of it. Cloudflare's Managed Transform "Add security headers" does not add this header. If a framework or hosting control panel inserts 1; mode=block automatically, look for the "legacy security headers" setting and disable it. Then spend the time you saved on the CSP guide, which is where reflected-XSS mitigation actually lives now.
Where this fits
X-XSS-Protection (deprecated header) is check 13 of 13 that the website vulnerability scanner runs under http security headers, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.
Fix this one first
Above it in the same category sits Cross-Origin-Resource-Policy (info), where responses do not carry Cross-Origin-Resource-Policy, so other origins may embed them as scripts, images or fetches in no-cors mode and pull them into their process. An attacker who has that does not need this, so it is the better use of the same hour.
Found in the same scan
The website vulnerability scanner reports this alongside checks from other categories that are at least as serious, including Certificate chain and hostname validation, where the certificate presented for this hostname did not validate: The chain does not reach a trusted root, an intermediate is missing, the name does not match, or the certificate is self-signed or expired, and Exposed .env configuration file, where a .env configuration file is served from the web root. A single run of website vulnerability scanner answers all of them at once.
The first few lines
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.
Finding: X-XSS-Protection (deprecated header) (info severity)
Scanner check id: x-xss-protectionThe rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.
Sign in with GoogleSigning in is free and takes one click. We store your email address and nothing else.
References
Related guides
8 min read · Updated Sep 19, 2026
Cross-Site Scripting (XSS) Explained: Reflected, Stored, DOM-Based and How to Prevent It
XSS lets an attacker run their own script in your users' browsers. The three types, what an attacker does with it and the layered...
Read the guide
9 min read · Updated Sep 16, 2026
Content Security Policy (CSP): A Practical Guide to Writing One That Works
A Content Security Policy tells the browser which scripts, styles and resources a page may load, which defeats most cross-site...
Read the guide