X-XSS-Protection
A legacy header that toggled older browsers' built-in reflected-XSS filter. Deprecated in favour of Content-Security-Policy.
What it does
X-XSS-Protection used to control a heuristic filter built into older versions of Internet Explorer, Chrome, and Safari that tried to detect and block reflected cross-site scripting attacks on the fly.
Why it matters
Modern browsers have removed this filter entirely: Chrome, Edge, and Safari no longer implement it, and the header is simply ignored. Worse, the underlying feature was found to introduce its own vulnerabilities in some cases, which is part of why it was retired.
Domain Flock lists this header as informational, not because you need to add it, but because a stray X-XSS-Protection: 1 can in rare, filter-specific edge cases be turned against a page. If you're not actively supporting legacy IE/Chrome, the safest move is to leave it unset and rely on a strong Content-Security-Policy instead.
Recommended value
If you do set it, 0 (explicitly disabled) is the current recommendation from most browser vendors and security guides: it avoids relying on a retired, inconsistent legacy filter.