A rated company appealed Bitsight’s grading of the X-XSS-Protection header in the Web Application Headers Risk Vector. Currently, Bitsight assesses headers that are minimum expectations, referred to as required headers, and those that may be implemented optionally depending on the configuration of the web page. The X-XSS-Protection header is considered an optional header; these headers carry no weight if not included, and if included they can contribute positively or negatively to the impact of the record depending on its implementation.
After deliberation, the Policy Review Board decided to recommend a change in policy when possible to no longer grade this header. This decision was reached because (1) well-configured Content Security Policy implementations can render this header redundant, (2) OWASP now recommends setting the header to zero to disable the X-XSS-Protection auditor, and (3) almost all major browsers have depreciated the header.