How to disable blocking with X–XSS–Protection

Previous versions of Helmet and x-xss-protection allowed you to remove the mode=block directive. This functionality was removed because it is not recommended.

If you still need to do that, you can write your own small middleware:

// NOTE: This is discouraged.
app.use((req, res, next) => {
  res.setHeader("X-XSS-Protection", "1");
  next();
});