Safety
X-XSS-Protection vs CSP for XSS Defense
August 22, 2026
X-XSS-Protection vs CSP is not a close race. X-XSS-Protection enabled the old IE/Chrome XSS auditor. That filter is retired, inconsistent, and has caused bypass-and-worse stories. Content-Security-Policy (enforcing, with nonces or hashes — not unsafe-inline forever) is the current browser control for unexpected scripts. Marketing sites should ship CSP and may set X-XSS-Protection: 0 so leftover auditors stay off. Do not add 1; mode=block as a 'security header win.' RoastMyOpsec grades CSP quality on the primary HTML response. It does not run XSS payloads and it does not treat a missing auditor header as a failure.
The practical difference
The auditor tried to guess reflected XSS in the response. Guessing is not a policy. CSP lists what may run. Trusted Types (later) lists how the DOM may be written. HttpOnly cookies reduce theft of the session if XSS still happens.
Some CDNs still emit X-XSS-Protection: 1; mode=block from a 2016 template. Delete it or set 0.
How to choose what to send
Enforce CSP (frame-ancestors now, script-src as soon as tags allow). Optional: X-XSS-Protection: 0. Do not spend a sprint tuning the auditor. Pair with report-only vs enforcing and nonces vs hashes.
| Header | Status | What to do | Takeaway |
|---|---|---|---|
| CSP enforcing | Current | Nonce/hash; no forever unsafe-inline | This is the control |
| X-XSS-Protection: 0 | Disables leftover auditors | Fine if a template insists on the header | Better than 1; mode=block |
| X-XSS-Protection: 1; mode=block | Obsolete / risky | Remove | Not a CSP substitute |
| Missing both | No XSS policy | Add CSP | Auditor would not have saved you anyway |
What the roast can see
CSP looseness and presence. An auditor header is not a scoring trophy. A 10/10 header pack still is not a pentest — see defensive audit vs penetration test.
Common mistakes
The first mistake is a checklist that still requires XSS-Protection 1.
The second mistake is mode=block plus unsafe-inline CSP.
The third mistake is disabling CSP because 'we have the auditor.'
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Should I enable X-XSS-Protection?
- No. Prefer CSP. If the header must exist, send 0. Do not use 1; mode=block as your XSS plan.
- Does RoastMyOpsec fail sites without X-XSS-Protection?
- No. The free header pack cares about CSP, HSTS, framing, Referrer-Policy, nosniff, and Permissions-Policy.
- Is XSS-Protection the same as Trusted Types?
- No. Trusted Types is a modern DOM-sink policy. The auditor is a retired heuristic. See Trusted Types vs CSP.