Articles/HTTP

X-XSS-Protection Header Explained

What the HTTP X-XSS-Protection header does and when it's used.

Published October 16, 2026

The X-XSS-Protection header a legacy header that enabled a browser's built-in XSS filter.

Key points

  • Deprecated in modern browsers in favor of Content-Security-Policy, but still sometimes seen in older configurations
More HTTP articles