What is Cross-Site Scripting?
Cross-site scripting (XSS) is an attack where malicious scripts are injected into a trusted website and executed in visitors' browsers. XSS can steal sessions and data; escaping output and a strong CSP are the main defenses.
Why Cross-Site Scripting matters
XSS is the injection of script into a page that other people view: a comment that contains a <script> tag and is rendered unescaped, a search term echoed into the HTML, a URL parameter written into the DOM by JavaScript. The script runs with the site's own privileges, so it can read cookies and local storage, act as the logged-in user, deface the page or redirect to a phishing site. It has been in the OWASP Top Ten in every edition.
Defence has two layers. Encode all untrusted data for the context it is placed in (HTML, attribute, URL, JavaScript), which modern frameworks do by default until a developer opts out with something like dangerouslySetInnerHTML or innerHTML. Then assume a mistake will happen and limit the damage with a Content Security Policy, HttpOnly cookies and a strict Referrer Policy.
Example
Reflected input, unsafe and safe:
// Unsafe: attacker-controlled q lands in the page as HTML
results.innerHTML = 'Results for ' + q;
// Safe: rendered as text, never parsed as markup
results.textContent = 'Results for ' + q;Same feature, one API choice apart.
Common mistakes
- •Trusting data because it came from your own database (it came from a user first).
- •Building HTML by string concatenation.
- •Skipping CSP because 'we escape everything'; one missed spot is enough.
How Webmatik checks it
Webmatik does not attempt exploits; it scores the defences that limit XSS: Content Security Policy (CSP), Cookie security flags (HttpOnly, Secure, SameSite), Referrer Policy and MIME type sniffing protection.
Check your own site
Free Website Security Checker
HTTPS, HSTS, CSP and the other headers most sites are missing — with exactly what to add.
Related Security terms
See how your website scores across SEO, GEO, performance, and more
Run a free audit