v2.9.8.4

Turn Off the X-XSS-Protection Header, and More Reliable Backups

You can now stop a site from sending the old X-XSS-Protection header that security scanners flag. Backups to S3-compatible storage now work on servers that block running programs from the temporary folder.

⚡ Improvements

• Remove the X-XSS-Protection header. Browsers no longer use this header, and some security scans report it. A new Remove X-XSS-Protection header switch on the site’s security settings leaves it out, on Nginx and OpenLiteSpeed. Your other security headers stay. Sites you don’t change keep the header as before.

🐞 Bug Fixes

• Backups
  • Backups to S3-compatible storage now work on servers that block running programs from /tmp. xCloud also reinstalls its backup tool when the installed copy can’t run.
• Cloudflare
  • With Cloudflare Enterprise, www and other subdomains now show as routed instead of Pending when your DNS flattens CNAME records.