X-XSS-Protection is obsolete / deprecated and should be removed

[Daniel Ruf]

Describe the bug
X-XSS-Protection is obsolete for a few years now and not supported by browsers anymore. This header will do nothing and at least caused privacy and security issues in the past.

To Reproduce

Expected behavior
Remove the X-XSS-Protection header.

Additional context
See also:
https://caniuse.com/mdn-http_headers_x-xss-protection
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection

[Daniel Ruf]

Done at https://github.com/wp-cli-secure/wp-cli-secure-command (https://github.com/wp-cli-secure/wp-cli-secure-command/commit/bc9573664abec35389688fc326ae2c45b629a449).

[Igor Hrček]

Agreed, this should be handled by CSP policy.

[Igor Hrček]

🎉 This issue has been resolved in version 1.17.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀