---
title: "Protection Against Reflected Cross-Site Scripting Attacks Is Disabled"
description: "Impact Area Security Severity Medium Affected Element Org Config ## Rule ID **SF-0165** ## Impact Increased vulnerability to cross-site scripting attacks. ## Remediation Enable this setting. From Setup, enter “Session Settings” in the Quick Find box, then select Session Settings.…"
url: "https://community-staging.qualityclouds.com/qcdocs/qc/salesforce-rules/protection-against-reflected-cross-site-scripting-attacks-is-disabled/"
updated: "2025-03-21"
category: Rules
---

# Protection Against Reflected Cross-Site Scripting Attacks Is Disabled

Impact Area

Security

Severity

Medium

           Affected Element

Org Config

## Rule ID

**SF-0165**

## Impact

Increased vulnerability to cross-site scripting attacks.

## Remediation

Enable this setting. From Setup, enter “Session Settings” in the Quick Find box, then select Session Settings. Then enable “XSS protection”.

### Time to fix

30 min

This rule is linked to [Common Weakness Enumeration CWE-79 Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)](https://cwe.mitre.org/data/definitions/79.html).