firewall not blocking obvious traffic

[bitslip6]

using the php bootstrap with no framework have xss protection enabled for GET, POST, COOKIE at firewall/panel/security/xssProtection/

the url mysite.com/someurl/test= is not blocked.

Am I doing something wrong?

thanks!