Because X-XSS-Protection header is now not supported by major browsers I wonder what option is better, to delete this header or to set the header as X-XSS-Protection: 0?
Because browsers do not support this header I think the better option is just to delete it, but OWASP recommends to set the header as X-XSS-Protection: 0, because its use can introduce additional security issues on the client side.
And when I check websites like Facebook this header is set like in OWASP recommendation.
I think that this setting can be useful if for example my application is used by very old browsers, but if used by modern browsers this header will be just ignored, so there is no need for using it. Am I right?