diff --git a/webgoat-lessons/cross-site-scripting/src/main/resources/html/CrossSiteScriptingMitigation.html b/webgoat-lessons/cross-site-scripting/src/main/resources/html/CrossSiteScriptingMitigation.html
index 8a3ee060a..f979b6942 100644
--- a/webgoat-lessons/cross-site-scripting/src/main/resources/html/CrossSiteScriptingMitigation.html
+++ b/webgoat-lessons/cross-site-scripting/src/main/resources/html/CrossSiteScriptingMitigation.html
@@ -14,6 +14,10 @@
 	<div class="adoc-content" th:replace="doc:CrossSiteScripting_content8a.adoc"></div>
 </div>
 
+<div class="lesson-page-wrapper">
+	<div class="adoc-content" th:replace="doc:CrossSiteScripting_content9.adoc"></div>
+</div>
+
 <div class="lesson-page-wrapper">
 	<div class="adoc-content" th:replace="doc:CrossSiteScripting_content8b.adoc"></div>
 	<div class="attack-container" style="height: 100%; border: none !important;min-height: 450px;">
@@ -34,8 +38,4 @@
 	</div>
 </div>
 
-<div class="lesson-page-wrapper">
-	<div class="adoc-content" th:replace="doc:CrossSiteScripting_content9.adoc"></div>
-</div>
-
 </html>
\ No newline at end of file