Skip to content
DevMarDe
Crawl Audit check 152Crawl AuditSecurity

Legacy X-XSS-Protection: Crawl Audit check 152

Crawl Audit check 152 looks for X-XSS-Protection or a CSP. Why the old header is deprecated, what OWASP now advises, and what to set up instead.

Zain Kazmi2 min read
On this page
  1. What Crawl Audit checks
  2. What the sources say
  3. What to do
  4. On devmarde.com
  5. Sources
Check
152 of 200
Module
Security & Infrastructure
Group
HTTP Security Headers
Impact
Low

Short answer: X-XSS-Protection switched on a cross-site scripting filter in older browsers. MDN now marks it deprecated and non-standard, and OWASP advises not sending it, or sending 0. The real protection is a Content-Security-Policy. Check 152 passes if you have either this header or a CSP.

What Crawl Audit checks

  • Pass: an X-XSS-Protection header, with any value.
  • Pass: no X-XSS-Protection, but a Content-Security-Policy is set.
  • Warning: neither. The advice is to add a CSP (check 149), not this header.

Because any value passes, a site sending the old 1; mode=block passes too, even though current advice has moved on.

What the sources say

  • MDN: "Avoid using this feature in new projects." And: "It is recommended that you use Content-Security-Policy instead of XSS filtering."
  • OWASP: "Do not set this header or explicitly turn it off." Its example is X-XSS-Protection: 0.

What to do

  • If you send 1; mode=block today, change it to 0 or remove it.
  • Put the effort into a CSP instead (check 149).

On devmarde.com

We send neither this header nor a CSP, so this check warns for us. Our fix is the CSP, not this header; check 149 explains where that stands.

Sources

All 200 Crawl Audit checks

See how your site does on every check.

Crawl Audit runs this check and 199 others on your domain. The full report is $7.89, one time. The free check on this site covers 25.

Run Crawl Audit · $7.89Free AI visibility check