# defender-security/3.0.1/src/component/security-headers/sh-xss-protection.php

Defender Security – Malware Scanner, Login Security & Firewall, version 3.0.1. 99 lines.

- Page: https://pluginprobe.com/plugins/defender-security/3.0.1/code/src/component/security-headers/sh-xss-protection.php
- Raw: https://pluginprobe.com/plugins/defender-security/3.0.1/raw/src/component/security-headers/sh-xss-protection.php
- Modified: 2022-06-16T08:36:34+00:00

Line numbers below start at 1. Link to a line or a range by appending a fragment to the
page URL, for example `https://pluginprobe.com/plugins/defender-security/3.0.1/code/src/component/security-headers/sh-xss-protection.php#L10-L20`.

```php
<?php
/**
 * Author: Hoang Ngo
 */

namespace WP_Defender\Component\Security_Headers;

use WP_Defender\Component\Security_Header;

class Sh_XSS_Protection extends Security_Header {
	static $rule_slug = 'sh_xss_protection';

	public function check() {
		$model = $this->get_model();

		if ( ! $model->sh_xss_protection ) {
			return false;
		}
		if ( isset( $model->sh_xss_protection_mode ) && ! empty( $model->sh_xss_protection_mode ) ) {
			return true;
		}
		$headers = $this->head_request( network_site_url(), self::$rule_slug );
		if ( is_wp_error( $headers ) ) {
			$this->log( sprintf( 'Self ping error: %s', $headers->get_error_message() ) );

			return false;
		}

		if ( isset( $headers['x-xss-protection'] ) ) {
			$header_xss_protection = is_array( $headers['x-xss-protection'] )
				? $headers['x-xss-protection'][0]
				: $headers['x-xss-protection'];
			$content               = strtolower( trim( $header_xss_protection ) );
			$content               = explode( ';', $content );
			if ( 1 === count( $content ) ) {
				$model->sh_xss_protection_mode = 'sanitize';
			} else {
				$content                       = explode( '=', $content[1] );
				$model->sh_xss_protection_mode = $content[1];
			}
			$model->save();

			return true;
		}

		return false;
	}

	/**
	 * @return array
	 */
	public function get_misc_data() {
		$model = $this->get_model();

		return array(
			'intro_text' => esc_html__( 'The HTTP X-XSS-Protection response header that stops pages from loading when they detect reflected cross-site scripting (XSS) attacks on Chrome, IE and Safari.', 'wpdef' ),
			'mode'       => $model->sh_xss_protection_mode ?? 'sanitize',
		);
	}

	public function add_hooks() {
		add_action( 'send_headers', array( $this, 'append_header' ) );
	}

	public function append_header() {
		if ( headers_sent() ) {
			return;
		}
		$model = $this->get_model();
		if ( ! $this->maybe_submit_header( 'X-XSS-Protection', false ) ) {

			return;
		}
		if ( true === $model->sh_xss_protection && in_array( $model->sh_xss_protection_mode, array( 'sanitize', 'block', 'none' ), true ) ) {
			$headers = '';
			switch ( $model->sh_xss_protection_mode ) {
				case 'sanitize':
					$headers = 'X-XSS-Protection: 1';
					break;
				case 'block':
					$headers = 'X-XSS-Protection: 1; mode=block';
					break;
				default:
					break;
			}
			if ( strlen( $headers ) > 0 ) {
				header( trim( $headers ) );
			}
		}
	}

	/**
	 * @return string
	 */
	public function get_title() {
		return __( 'X-XSS-Protection', 'wpdef' );
	}
}

```