Summary
Acunetix 360 detected a disabled X-XSS-Protection header which means that this website could be at risk of a Cross-site Scripting (XSS) attacks.
Internet Explorer's built-in cross-site scripting protection can be disabled by using the following HTTP Header : X-XSS-Protection: 0
Impact
This issue is reported as additional information only. There is no direct impact arising from this issue.
Remediation
Add the X-XSS-Protection header with a value of "1; mode= block".
-
X-XSS-Protection: 1; mode=block
Please also be advised that in some specific cases enabling XSS filter can be abused by attackers. However, in most cases, it provides basic protection for users against XSS attacks.