# Web Browser XSS Protection Not Enabled

**URL:** <https://community.sonarsource.com/t/web-browser-xss-protection-not-enabled/148238>\
**Category:** SonarQube Server / Community Build\
**Created:** [September 8, 2025, 10:08am UTC](https://community.sonarsource.com/t/web-browser-xss-protection-not-enabled/148238 "2025-09-08T10:08:26Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![sonar5722](https://avatars.discourse-cdn.com/v4/letter/s/e9a140/32.png) [@sonar5722](https://community.sonarsource.com/u/sonar5722)\
**Post date:** [September 8, 2025, 10:08am UTC](https://community.sonarsource.com/t/web-browser-xss-protection-not-enabled/148238/1 "2025-09-08T10:08:26Z")

</div>

- which versions are you using Community Build–\>25.6.0

- how is SonarQube deployed: Docker

- what are you trying to achieve: After deploying it via Dockerfile to a platform ,an url will be generated. But if we click on the inspect in the page , in network –\>Sonarqube folder–\>in the headers section xss protection is Zero.

- Please let us know if this is not configured to secure this cross site hijack thing ,are there any impact ? If yes what are the mitigation steps we need to follow?

---

<div class="post-metadata">

**Author:** ![Scott](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/scott/32/3175_2.png) [@Scott](https://community.sonarsource.com/u/Scott)\
**Post date:** [September 8, 2025, 10:31am UTC](https://community.sonarsource.com/t/web-browser-xss-protection-not-enabled/148238/2 "2025-09-08T10:31:12Z")

</div>

I suppose you’re talking about the [non-standard X-XSS-Protection](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-XSS-Protection), which is mostly ineffective now since most browsers simply ignore it. It has been replaced by Content-Security-Policy.

Anyway, it’s a good practice to put SonarQube behind a reverse proxy like nginx. If you really need to add a useless header like this one you can do it there.