XSS involves untrusted content executing as script in a page. Public headers provide useful context but cannot prove the absence of XSS in application code.
The following checks provide related public observations. Their presence does not mean this entire topic has been tested or that the application is secure.
Checks for a Content-Security-Policy that blocks inline scripts. Severity rises when the page has a login.
Add a Content-Security-Policy that lists allowed script sources and avoids 'unsafe-inline' (use nonces or hashes instead). Start with Content-Security-Policy-Report-Only to test.
Checks that cookies that look like sessions are Secure, HttpOnly and have SameSite.
Set session cookies with Secure, HttpOnly and SameSite=Lax (or Strict).
A blocked or unfinished check remains unverified. Review technical recommendations with the person operating the website and test changes before applying them to a live service.
Read the full methodology