XSS protection
We close cross-site scripting (XSS) vulnerabilities: correct output encoding, sanitization of user input/HTML, Content Security Policy, safe DOM handling. So someone else's script does not execute in your users' browsers and does not steal data/sessions. Honestly upfront: we substantially reduce XSS risk and close the found spots, but XSS protection is discipline across the whole code, not one 'magic' setting; only constant correctness gives a full guarantee.
XSS protection — overview
XSS protection is a project: we check user-data output points, implement correct context-aware encoding (HTML/attributes/JS/URL), sanitization of user HTML (where allowed), safe DOM patterns (avoiding innerHTML/eval), set up a Content Security Policy as an additional barrier, fix found XSS. Honestly about the nature, this is key: XSS arises wherever user data reaches the page without correct encoding — this permeates the WHOLE code, so XSS protection is not one setting but a DISCIPLINE: we close the found spots and implement correct patterns/barriers (CSP), which substantially reduces risk, but absolute protection comes only from consistent correctness across all code, including future — new unsafe code will create XSS again. Honestly about CSP: it is a strong additional barrier (restricts execution of foreign scripts), but not a 'silver bullet' and requires careful setup (see 754). Honestly about found vs all: we fix identified vulnerabilities and reduce risk, but do not guarantee that none remains (especially in large/dynamic code) — for a deep check an audit/pentest is needed. Honestly about combination: XSS protection is critical together with session/CSRF protection (a session stolen via XSS bypasses them). Honestly about access: access to the code is needed. An important boundary: this is XSS protection, not CSP as separate deep setup (754 — adjacent), not a full code audit and not a WAF (a filter, not a fix). Picture this: instead of 'an entered script executes for other users' — correct encoding and a CSP barrier. The base price starts from 15,000 ₽ per project; it depends on the code volume.
Problems we solve
- User input is output without encoding (XSS).
- Dangerous patterns (innerHTML/eval) in the code.
- There is no CSP as a barrier against foreign scripts.
- Via XSS data and sessions can be stolen.
What's included in the XSS protection service
- Checking user-data output points
- Context-aware encoding (HTML/attributes/JS/URL)
- Sanitization of user HTML (where allowed)
- Safe DOM patterns
- Setting up CSP as an additional barrier
- Fixing found XSS
- Indicating boundaries (whole-code discipline, not one-off magic)
- Handover and review with you
What you get
- Found XSS closed, risk substantially reduced
- Correct encoding and safe DOM
- A CSP barrier against execution of foreign scripts
- Protection in combination with sessions/CSRF (full — code discipline)
How the work goes: steps
- We check output points and dangerous patterns; collect code access
- We implement encoding, sanitization, CSP, fix what is found
- We test, review with you and embed correct patterns
Why PDV Expert
- Fixed price and timeline — no surprises on the invoice.
- Report and recommendations in plain language — clear without a technical background.
- In touch at every step and answering questions about the result.
FAQ
Do you guarantee no XSS will remain?
We substantially reduce risk and close the found spots + add a CSP barrier, but absolute guarantee comes only from consistent correctness across all code, including future. In large/dynamic code we do not rule out that something remains — for a deep check an audit/pentest is needed.
Is CSP a complete XSS solution?
No, it is a strong additional barrier (restricts execution of foreign scripts), but not a 'silver bullet' and requires careful setup. The basis is correct output encoding; CSP strengthens protection but does not replace it.
Doesn't a WAF filter XSS?
A WAF filters typical patterns in front of the application, but that is not a vulnerability fix — a targeted attack can bypass the filter. Real protection is correct code (encoding/sanitization). A WAF and XSS protection complement each other.
About the provider
The «XSS protection» service is provided by PDV Expert — a team specialising in «Site quality». We work under contract and deliver a written report with recommendations.