Cybersecurity Glossary
Cross Site Scripting
A flaw that lets an attacker run their own script inside your website, in your visitor's browser.
What Cross Site Scripting means
If a site displays user supplied content without cleaning it first, an attacker can inject script that then runs for every visitor who views that page. The script can steal session cookies, rewrite the page, or redirect a payment form to a lookalike. The visitor sees your real address in the bar, which is what makes it effective.
Why Cross Site Scripting matters for small businesses and nonprofits
Comment fields, search results, review forms and anything that echoes back what a user typed are the usual weak points. For a site handling logins or payments, the consequence is account takeover of your own customers.
What to do about Cross Site Scripting
- Keep your platform and plugins current, since most such flaws are fixed upstream
- Set a content security policy so the browser refuses unexpected scripts
- Have the site tested if it accepts and displays user content
Not sure where you stand on this?
We review your current setup against the basics, tell you plainly what is covered and what is not, and give you a ranked list with effort and cost. No jargon and no scare tactics.