Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Turn on Cross-Site Scripting Filter

The `1409` registry value controls the Internet Explorer Cross-Site Scripting (XSS) Filter for websites in the Internet Zone.

since 0.9.8.11

Purpose

Show registry keys (2)
  • HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1409
  • HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1409

The 1409 registry value controls the Internet Explorer Cross-Site Scripting (XSS) Filter for websites in the Internet Zone. The filter examines cross-site script injections and attempts to block content that it identifies as an XSS attack.

The value uses the REG_DWORD data type. The relevant data values are:

  • 0: The XSS Filter is turned on.
  • 3: The XSS Filter is turned off.

This setting applies only to the Internet Zone, identified by zone number 3. It does not change which security zone a website belongs to.

Notes

Security

When enabled, the filter provides an additional client-side defense against certain reflected XSS attacks. These attacks cause a vulnerable website to include manipulated request data in its response, where the browser may execute it as script. Successfully executed code can access content and functions available within the affected website's security origin.

A value of 3 removes this layer of protection from the Internet Zone. Internet Explorer then does not attempt to block the corresponding cross-site script injections through this filter.

The filter is a defense-in-depth measure rather than complete XSS protection. It does not prevent every type of XSS vulnerability and does not replace secure web application design or other browser and operating-system protections.

Notes

The HKLM path holds the computer-scoped policy value, while the HKCU path holds the user-scoped value. An absent value is not equivalent to a value of 3; the effective behavior can instead be determined by another policy scope or by the applicable zone configuration.

This setting belongs to the Internet Explorer policy family. It does not configure XSS protections in the Chromium engine used by Microsoft Edge.

Microsoft documentation

Microsoft Learn: InternetZoneEnableCrossSiteScriptingFilter

Microsoft Learn: URL Policy Flags

See also