Turn on Cross-Site Scripting Filter

Purpose

Show registry keys (2)

• HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1409
• HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1409

This setting controls the Internet Explorer engine's Cross-Site Scripting (XSS) Filter for websites in the Restricted Sites zone. The 4 in the registry path identifies that security zone, while the value name 1409 represents the URLACTION_SCRIPT_XSSFILTER URL action (0x00001409).

The value uses the REG_DWORD type. A value of 0 turns the filter on, while 3 turns it off. When enabled, the Internet Explorer engine attempts to detect and block cross-site script injections. When disabled, it does not apply this filtering to content in the affected zone.

The HKLM entry has computer scope, whereas the HKCU entry has per-user scope. The setting applies only to content classified in the Restricted Sites zone.

Notes

Security

The filter provides an additional layer of protection against cross-site scripting. A successful XSS attack can cause injected script to run in the security context of another website, potentially exposing data or operations available to that website in the browser.

Turning the filter off removes this protection and permits cross-site script injections from the perspective of this URL action. It does not override other security-zone controls: the setting does not enable Active Scripting or grant any additional browser or operating-system permissions.

An enabled filter does not correct XSS vulnerabilities in a web application and cannot guarantee detection of every injection attempt. Applications must still handle untrusted content securely on the server and within the application itself.

Possible side effects

The filter can classify web content as a script-injection attempt and modify or block it. Legitimate sites—particularly legacy applications that use cross-domain script or URL patterns—may consequently lose some functionality.

Notes

This URL action determines the Internet Explorer engine's default behavior when the HTTP response does not contain an X-XSS-Protection header that controls the feature.

The setting belongs to the Internet Explorer policy architecture and does not generally affect pages rendered by the modern Microsoft Edge engine. Internet Explorer mode tabs use the Trident/MSHTML engine, however, and evaluate Windows Security Zone settings in the same manner as Internet Explorer.

Microsoft documentation

Microsoft Learn: InternetExplorer Policy CSP – RestrictedSitesZoneEnableCrossSiteScriptingFilter

Microsoft Learn: Per-site configuration by policy – Windows Security Zones and IE mode

Microsoft Learn: URL Action Flags – URLACTION_SCRIPT_XSSFILTER

See also

• Entry in the reference