Is there any plugin out there which prevent reflected XSS? Plugin could be either for firefox or chrome.


  • no-script for firefox, none of these filers work very well.
    – rook
    Oct 1, 2013 at 16:30

1 Answer 1


Chrome ( and most likely Firefox ) already prevent execution of scripts when they are given in for example the URL parameter, maybe even other things like a request body, and then proceed to give you a warning.

See also Does Google Chrome protect against cross site scripting (XSS)?

Also when you search for XSS prevention in the chrome extension store, you will get results.

  • I tried a reflected XSS on insecurelabs.org/Task/Rule1. It works in chrome as well as firefox. here search box in vulnerable to xss
    – Naman
    Oct 1, 2013 at 14:49
  • That website sends an http header of "X-XSS-Protection:0", you can guess what that does. You cannot use that website to test a browser's XSS Protection. See also this question Oct 1, 2013 at 15:11
  • Nice. But now I am making a simple page and running it on apache local server, still reflected xss happening
    – Naman
    Oct 1, 2013 at 17:01
  • What would you say about victim.kotowicz.net/alphabet-hero/vuln.html
    – Naman
    Oct 1, 2013 at 17:04
  • That is a page where javascript reads the input field and just appends the text as html, the xss data does not come from a request... Oct 2, 2013 at 7:24

Not the answer you're looking for? Browse other questions tagged or ask your own question.