Which of the following can be implemented in hardware or software to protect a web server from cross-site scripting attacks?

An Intrusion Detection System monitors and alerts on suspicious network traffic but does not perform application-layer HTTP inspection to actively block XSS attacks.

Flood guard protection mitigates volumetric denial-of-service attacks and does not inspect or filter web application request payloads for embedded scripts.

A Web Application Firewall operates at Layer 7 and understands HTTP/HTTPS traffic, allowing it to detect and block malicious payloads such as XSS scripts before they reach the web server. WAFs can be deployed as hardware appliances, software modules, or cloud services and apply rule sets specifically tailored to web application attacks. No other option in the list provides application-layer HTTP inspection capable of blocking XSS payloads.

A URL content filter restricts access to websites by category or URL reputation but does not inspect request and response bodies for embedded XSS payloads.