Merge pull request #13445 from nextcloud/fix/nginx-xss-protection-header

docs(admin): remove X-XSS-Protection header from Nginx assets

Author: rakekniven

admin_manual/installation/nginx-root.conf.sample

@@ -1,4 +1,4 @@
-# Version 2024-07-17
+# Version 2025-07-23
 
 upstream php-handler {
     server 127.0.0.1:9000;
@@ -179,7 +179,6 @@ server {
         add_header X-Frame-Options                   "SAMEORIGIN"        always;
         add_header X-Permitted-Cross-Domain-Policies "none"              always;
         add_header X-Robots-Tag                      "noindex, nofollow" always;
-        add_header X-XSS-Protection                  "1; mode=block"     always;
         access_log off;     # Optional: Don't log access to assets
     }
 

admin_manual/installation/nginx-subdir.conf.sample

@@ -1,3 +1,5 @@
+# Version 2025-07-23
+
 upstream php-handler {
     server 127.0.0.1:9000;
     #server unix:/run/php/php8.2-fpm.sock;
@@ -176,7 +178,6 @@ server {
             add_header X-Frame-Options                   "SAMEORIGIN"        always;
             add_header X-Permitted-Cross-Domain-Policies "none"              always;
             add_header X-Robots-Tag                      "noindex, nofollow" always;
-            add_header X-XSS-Protection                  "1; mode=block"     always;
             access_log off;     # Optional: Don't log access to assets
         }