Why X-XSS-Protection no longer matters
X-XSS-Protection was an early browser header that turned on a built in filter meant to catch reflected cross site scripting attacks. The idea was reasonable for its time, but the filter was crude. It produced false positives, broke legitimate pages, and in some cases attackers learned to abuse the filter itself to leak information or disable parts of a page. For those reasons the major browsers removed the underlying feature, and the header is now deprecated. Setting it does almost nothing in Chrome, Edge, or Safari today.
Content Security Policy is the modern defense
The protection that actually stops cross site scripting now is a Content Security Policy. A CSP lets you declare exactly which sources a page may load scripts from, so even if an attacker injects a script tag, the browser refuses to run it because it is not on your allowlist. A well written policy that avoids unsafe-inline and uses nonces or hashes for the scripts you do trust closes off the most common injection paths. That is the layer worth investing in, and it is what this checker looks for alongside the legacy header.
What to do about it
The guidance is simple. Either set X-XSS-Protection to 0 to explicitly disable the old filter, or remove the header entirely, since current browsers ignore it either way. Then put your effort into deploying a strong Content Security Policy. When you are ready to write one, the free CSP generator produces a policy you can copy straight into your server or app, and you can confirm an existing policy is sound with the CSP validator.