Security Headers

X-XSS-Protection check

A retired header. Modern browsers ignore it, and the old filter it switched on could be abused, so it is best left out or set to 0.

Check this on your own domain now. It is free with a DomainGuard account and works on any domain. The check reads only what your domain publishes, and gives you a report you can send to whoever runs your website.

Run the Security Headers CheckerRun every check

What we look at

We read the X-XSS-Protection header. This row is information only and never counts against your score: leaving it out, or sending 0, is the current advice.

Why it matters to your business

This one is mostly housekeeping: its presence or absence does not protect visitors today. Content-Security-Policy is the header that does its job now.

How to fix it

  1. Send X-XSS-Protection: 0, or remove it, and put the effort into a Content-Security-Policy.

If you would rather not touch DNS or server settings yourself, forward this page and your report to whoever manages your website, or ask us to do it.

Check your own site for this

A free outside-in check of your website, email and domain records, with what to fix first. No card and no password to choose.

Free, no card, no password to choose: your name and email make a free DomainGuard account that keeps the report, and we email you a link to confirm it. We only read what the internet can already see.