Most of the browsers supports the X-XSS-Protection header to prevent XSS atatcks. How we can enable this header in a ASP.Net MVC application?

Do we need to enable it in the application or do we need to do some configuration in the IIS?

  • 1
    See here: stackoverflow.com/questions/4635403/… (Answers explicitly refer to ASP.Net.)
    – Arminius
    Jan 20, 2017 at 5:53
  • Just don't rely on that header as your only protection in XSS - it is not perfect in all situations. But it can still be good in some situations. Also, in IE8 (and possibly others, don't remember) it can actually introduce vulnerabilities so you might want to check the user agent before you add the header.
    – Anders
    Jan 20, 2017 at 8:46

1 Answer 1


If your Web app is an ASP.Net MVC application , it is very easy to enable using the web.config file. All you need to do is add a Custom Header as in the following config entry.

        <remove name="X-Powered-By" />
        <add name="X-XSS-Protection" value="1; mode=block" />

It is always better if you can cconfigure the IIS Response header section as well.

enter image description here

  • Corrected tagging <remove name="X-Powered-By" /> <add name="X-XSS-Protection" value="1; mode=block" /> otherwise it shows error.
    – ABB
    Sep 14, 2017 at 6:53
  • In my case, I have to place it within <system.webserver> tag.
    – gamal
    Dec 27, 2021 at 6:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .