Tech teamRunning a website or small org
Cross-site scripting (XSS)
Malicious scripts planted in your pages, run by your visitors.
Understand it
If your site shows user-supplied content without cleaning it, an attacker can insert code that runs in other visitors’ browsers - taking their sessions or defacing the page.
How to spot it
On your own app: anywhere user content is shown back - comments, names, messages - without escaping.
Close the gap
- Escape all user content on display, encoded for its context.
- Use a strict Content Security Policy to limit what may run.
- Prefer frameworks that escape output by default.
- Treat anything a user can type as untrusted, always.
What to do about it
This sits with whoever builds and runs your website or systems - it’s beyond what a personal plan should promise to fix. If that’s not you, hand it to whoever looks after your security. We’d rather be honest about where we stop.
Your own accounts and devices are still worth protecting; your plan covers those.