@99spanchal
You can check the below points, if this issue is not resolved yet.
1. any other config file in project which is taking precedence of the /apps/cq/xssprotection/config.xml - verify in the HTML source of the page or in the Apache Sling XSS protection config - policy path value
2. If there is a SP upgrade done recently, do check if the latest config file is overlaid to /apps
3. try this <a ${button.skipLinkChecker ? 'x-cq-linkchecker' : ''}="anything">Test anchor link</a>
4. As mentioned in this thread, you should restart AEM instance for the new config to apply.