# Legacy (/en/docs/web-security/policies/legacy-headers)



Several older security headers have been superseded by newer, reporting-aware
policies. This page maps each legacy header to its modern replacement and says
whether it is still worth sending, so you can clean up a header set without losing
protection.

## At a glance [#at-a-glance]

| Legacy header                                                               | Status        | Modern replacement                                                                                         | Replacement status | Still send it                                      |
| --------------------------------------------------------------------------- | ------------- | ---------------------------------------------------------------------------------------------------------- | ------------------ | -------------------------------------------------- |
| [`X-Frame-Options`](/en/docs/web-security/security-headers/x-frame-options) | ⚠️ Deprecated | CSP [`frame-ancestors`](/en/docs/web-security/policies/content-security-policy/directives/frame-ancestors) | ✅ Good             | For old-browser coverage; `ALLOW-FROM` is obsolete |
| `Feature-Policy`                                                            | ⚠️ Deprecated | [Permissions-Policy](/en/docs/web-security/policies/permissions-policy)                                    | ✅ Good             | No                                                 |
| `X-XSS-Protection`                                                          | ⚠️ Deprecated | CSP (block inline scripts)                                                                                 | ✅ Good             | No, effectively dead; send `0`                     |
| `report-uri` (CSP)                                                          | ⚠️ Deprecated | `report-to` + [Reporting-Endpoints](/en/docs/web-security/reporting-api/headers/reporting-endpoints)       | ✅ Good             | Only for old browser versions                      |

## X-Frame-Options vs frame-ancestors [#x-frame-options-vs-frame-ancestors]

<Callout type="error" title="X-Frame-Options is legacy">
  The `ALLOW-FROM` value is obsolete and modern browsers ignore the whole header when they see it. Use CSP `frame-ancestors`.
</Callout>

The CSP `frame-ancestors` directive is the replacement for
[`X-Frame-Options`](/en/docs/web-security/security-headers/x-frame-options): it
takes a full source list, and a supporting browser uses it and ignores the header,
so sending both is reasonable defense in depth for old clients. For the value-by-value
mapping and which to send, see
[X-Frame-Options vs frame-ancestors](/en/blog/x-frame-options-vs-frame-ancestors).

## Feature-Policy vs Permissions-Policy [#feature-policy-vs-permissions-policy]

<Callout type="error" title="Feature-Policy is deprecated">
  Feature-Policy was renamed to Permissions-Policy during standardization and is no longer developed under the old name. Use [Permissions-Policy](/en/docs/web-security/policies/permissions-policy), which replaces it with revised allowlist syntax and adds Reporting API support.
</Callout>

[Feature-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-Policy)
controlled access to browser features but is deprecated. Migrate its directives to
Permissions-Policy, the feature names are largely the same, but the syntax differs
(allowlists in parentheses rather than space-separated lists), and Permissions-Policy
can report violations through the Reporting API.

## X-XSS-Protection vs CSP [#x-xss-protection-vs-csp]

<Callout type="error" title="X-XSS-Protection is effectively dead">
  The browser XSS auditor it controlled was removed from browsers because it could be abused. Rely on a strong CSP instead, and send `X-XSS-Protection: 0` to disable any residual legacy behavior.
</Callout>

The header switched on a built-in XSS auditor that had bypasses and could be turned
against legitimate scripts, so Chromium removed it. Real protection comes from a CSP
that blocks inline scripts: a `script-src` without `'unsafe-inline'`, using
[nonces or hashes](/en/docs/web-security/policies/content-security-policy/values/csp-hashes-nonce),
and Trusted Types.

## report-uri vs report-to and Reporting-Endpoints [#report-uri-vs-report-to-and-reporting-endpoints]

The reporting wiring evolved through three generations: the CSP `report-uri`
directive (deprecated), the
[`Report-To`](/en/docs/web-security/reporting-api/headers/report-to) header (deprecated), and the
current [`Reporting-Endpoints`](/en/docs/web-security/reporting-api/headers/reporting-endpoints)
header. The `report-to` directive is now cross-browser: Chrome has supported it for
years, and Safari and Firefox now support it too. Make `report-to` plus
`Reporting-Endpoints` the primary wiring, and keep `report-uri` only to cover users
on old browser versions, not whole engines. The legacy `Report-To` header is needed
only for [Network Error Logging](/en/docs/web-security/policies/network-error-logging);
the full story is in
[Report-To vs Reporting-Endpoints](/en/docs/web-security/reporting-api/concepts/report-to-vs-reporting-endpoints).

## Headers that are not superseded [#headers-that-are-not-superseded]

Not every old header is obsolete. [`X-Content-Type-Options: nosniff`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Content-Type-Options) (stops MIME-type
sniffing) and [`Strict-Transport-Security`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Strict-Transport-Security) (HSTS, enforces HTTPS) are still
recommended and have no reporting-based replacement, so keep them. Note that CSP
`upgrade-insecure-requests` complements HSTS but does not replace it; it upgrades
subresource requests, not the top-level navigation HSTS protects. The two dead TLS
headers with no header replacement at all, HPKP and Expect-CT, are covered in
[Deprecated headers](/en/docs/web-security/security-headers/deprecated-headers).

## See also [#see-also]

* [frame-ancestors directive](/en/docs/web-security/policies/content-security-policy/directives/frame-ancestors)
* [Permissions-Policy](/en/docs/web-security/policies/permissions-policy)
* [Report-To vs Reporting-Endpoints](/en/docs/web-security/reporting-api/concepts/report-to-vs-reporting-endpoints)
* [Legacy security headers to retire](/en/blog/legacy-security-headers-to-retire)
* Scan your header set with the [security headers scanner](/tools/security-headers).

## Sources [#sources]

* [MDN, X-Frame-Options](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Frame-Options)
* [MDN, CSP frame-ancestors](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/frame-ancestors)
* [MDN, Feature-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-Policy)
* [Chromium, XSS Auditor](https://www.chromium.org/developers/design-documents/xss-auditor/)