> ## Documentation Index
> Fetch the complete documentation index at: https://kb.hosting.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Preventing cross-site scripting (XSS) vulnerabilities in WordPress

> Protect your WordPress site from XSS attacks with the Prevent XSS Vulnerability plugin.

Cross-site scripting (XSS) is a security risk in which hackers inject malicious code into any vulnerable website's software. The code is activated in the victim's browser, allowing the attacker to impersonate the victim, perform any actions that the victim is capable of performing, and access any of the victim's data. If the victim user has privileged access to the application, the attacker may be able to gain complete control of the application's functionality and data. This article will show you how to use the Prevent XSS Vulnerability plugin to prevent XSS vulnerabilities in [WordPress](https://hosting.com/hosting/platforms/wordpress-hosting/managed-wordpress-hosting/).

## What is Prevent XSS Vulnerability plugin

[Prevent XSS Vulnerability](https://wordpress.org/plugins/prevent-xss-vulnerability/) is a plugin that protects against Reflected XSS and Self-XSS.In the case of Reflected XSS, it checks the URL and redirects it if the Enable Blocking option is enabled and the URL contains any Vulnerable code. It only blocks some parameters that are not permitted in URLs and displays the Block Parameters section.

## Installing and configuring Prevent XSS Vulnerability Plugin

To install and configure Prevent XSS Vulnerability Plugin, follow these steps:

1. Log in to your [WordPress](https://hosting.com/hosting/platforms/wordpress-hosting/managed-wordpress-hosting/) site with an administrator account.

2. On the **Dashboard** in the left sidebar, click **Plugins**, and then click **Add New**:\
   ![](https://static.hosting.com/kb/kb-wordpress-addnewplugin.png)

3. Search for "**Prevent XSS Vulnerability**" click Install, and then click **Activate** the plugin:\
   ![](https://static.hosting.com/kb/kb-wp-PreventXSSvulnerability.png)

4. On the **Dashboard** in the left sidebar, click on **Prevent XSS Vulnerability**:\
   ![](https://static.hosting.com/kb/kb-wp-PreventXSSVulnerability_menu.png)

5. Tick the checkbox to enable blocking, encoding and escaping and click on **Save Changes** to update the settings:\
   ![](https://static.hosting.com/kb/kb-wp-PreventXSSVulnerability-settings.png)![](https://static.hosting.com/kb/kb-wp-PreventXSSvullnerability-submit.png)

## More information

For more information about the Prevent XSS Vulnerability Plugin, please visit [https://wordpress.org/plugins/prevent-xss-vulnerability/](https://wordpress.org/plugins/prevent-xss-vulnerability/)

## Related articles

* [Changing a WordPress account username](/docs/changing-a-wordpress-account-username)

* [Configuring WordPress to always use SSL](/docs/configuring-wordpress-to-always-use-ssl)

* [Disable REST API in WordPress](/docs/disable-rest-api-in-wordpress)

* [Enabling HTTPS and SSL for WordPress sites](/docs/enabling-https-and-ssl-for-wordpress-sites)