Free X-XSS-Protection Header Checker (Deprecated)

Nginx

# Strip the deprecated header if anything upstream still sets it
proxy_hide_header X-XSS-Protection;
add_header X-XSS-Protection "" always;

# Replace it with a strict CSP
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'nonce-$request_id'; object-src 'none'; base-uri 'self'; require-trusted-types-for 'script'" always;
add_header X-Content-Type-Options "nosniff" always;

Apache

# Remove the deprecated header
Header always unset X-XSS-Protection

# Replace it with a strict CSP
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; require-trusted-types-for 'script'"
Header always set X-Content-Type-Options "nosniff"

Node.js (Express + Helmet)

import express from "express"
import helmet from "helmet"

const app = express()

// Helmet 5+ disables X-XSS-Protection by default; this makes it explicit
app.use(
  helmet({
    xXssProtection: false,
    contentSecurityPolicy: {
      directives: {
        defaultSrc: ["'self'"],
        scriptSrc: ["'self'"],
        objectSrc: ["'none'"],
        baseUri: ["'self'"],
        requireTrustedTypesFor: ["'script'"],
      },
    },
  }),
)