Error parsing header X-XSS-Protection: 1; mode=block, 1; mode=block: expected semicolon at character position 13. The default protections will be applied.
I am using Apache Server.
How to resolve it.

enter image description here

A solution below Can anyone explain correctly
X-XSS-Protection header gets set twice - override XssProtection.php

1 Answer 1


Well, The problem is to change the value of the HEADER_ENABLED to 0 because it conflicts with CloudFlare. To achieve this you need to edit this value manually in this core files and this is a very bad way to do this. So Magento Support overriding Methods by creating a plugin. Plugin, as Magento defines, is

A plugin, or interceptor, is a class that modifies the behavior of public class functions by intercepting a function call and running code before, after, or around that function call. This allows you to substitute or extend the behavior of original, public methods for any class or interface.

It actually changes the behavior of any method by three types of action

1- Before this one will change the arguments before entering the main method

2- Around this one will change the arguments before entering the main method and also can change the output of this main method

3- After It changes the output of the main method

to define a plugin you need to define it first in your di.xml

<type name="Magento\Framework\App\Response\HeaderProvider\XssProtection">
        <plugin name="disable_xssprotection_header"
                type="SR\MagentoCommunity\Plugin\Framework\App\Response\HeaderProvider\XssProtection" sortOrder="1"/>

name attribute in type used for the main class you need to add a plugin for then you need to add a custom name for the plugin and put your class in type attribute and the last attribute is the order of this plugin

After that you will create the plugin class

namespace SR\MagentoCommunity\Plugin\Framework\App\Response\HeaderProvider;

class XssProtection
    public function aroundGetValue(
        \Magento\Framework\App\Response\HeaderProvider\XssProtection $subject,
        \Closure $proceed
    ) {
        return 0;

he used the aroundMethod to return 0, However, he would better to use AfterMethod.

You can read more about Plugins from the Magento docs https://devdocs.magento.com/guides/v2.3/extension-dev-guide/plugins.html

But why he changed this file particularly In Magento store-module di.xml You will find this class passed to \Magento\Framework\App\Response\HeaderManager as an argument for x-xss-protection

<type name="Magento\Framework\App\Response\HeaderManager">
            <argument name="headerProviderList" xsi:type="array">
                <item name="HSTSHeader" xsi:type="object">Magento\Store\Model\HeaderProvider\Hsts</item>
                <item name="upgrade-insecure-requests" xsi:type="object">Magento\Store\Model\HeaderProvider\UpgradeInsecure</item>
                <item name="x-content-type-options" xsi:type="object">Magento\Framework\App\Response\HeaderProvider\XContentTypeOptions</item>
                <item name="x-xss-protection" xsi:type="object">Magento\Framework\App\Response\HeaderProvider\XssProtection</item>

and when we open this class you will find it will add all these arguments to the header of any response in Magento

public function beforeSendResponse(\Magento\Framework\App\Response\Http $subject)
        foreach ($this->headerProviders as $provider) {
            if ($provider->canApply()) {
                $subject->setHeader($provider->getName(), $provider->getValue());

So by overriding method getValue() it will return 0 for x-xss-protection, also the other solution of overriding canApply() can work because as you see in this code it won't be in the header not just = 0

I hope this helps you

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.