All Security Checks
HeadersMedium PriorityPro
Access-Control-Allow-Headers
This CORS header specifies which HTTP headers can be used during the actual cross-origin request.
Why It Matters
Overly permissive header allowlists can enable attacks using custom headers. Restricting allowed headers limits the attack surface.
How We Check
We analyze which headers are allowed and check for overly permissive configurations or security-sensitive headers.
How to Fix
Only allow headers your application actually needs. Avoid wildcards. Common safe headers: Content-Type, Authorization, X-Requested-With.
Related Security Checks
Related Tool
CORS Checker
Run all 6 related checks with our free cors checker
Check Your Website Now
Run a free security scan to check for Access-Control-Allow-Headers issues and 58+ other security vulnerabilities.
Scan Your Website Free