Header Security
Shopify XSS Protection Check
XSS attacks can compromise your Shopify store. Check that protection headers (X-XSS-Protection, CSP) are active to protect your customers.
What this test checks
This test checks for the presence of XSS protection headers on your Shopify store, notably X-XSS-Protection and a proper CSP configuration. XSS attacks can allow attackers to inject malicious scripts, steal sessions, and compromise user experience.
Our recommendation
Ensure X-XSS-Protection is set to '1; mode=block' and your CSP policy is correctly configured. Use a security scanner to identify potential XSS vulnerabilities in your themes and apps.
Security tests
Read more
Server Configuration