The misunderstood X-XSS-ProtectionA few days ago, I made a poll on Twitter to see what people think is the worst setting for the XSS filter/auditor. The results are very surprising: Which header setting of XSS filter/auditor do you think is the worst? — File Descriptor (@filedescriptor) March 17, 2016 In short, the worst goes to X-XSS-Protection: 0, followed by X-XSS-Protection: 1; mode=block, and finally X-XSS-Protection: 1 being
