All Security Checks
HeadersHigh PriorityPro
Access-Control-Allow-Origin
This CORS header specifies which origins can access your resources, controlling cross-origin data sharing.
Why It Matters
Misconfigured CORS can allow any website to read data from your API using victim's credentials. This is a common source of data breaches.
How We Check
We test CORS behavior with various origin values and check for dangerous patterns like reflecting arbitrary origins with credentials.
How to Fix
Use an explicit allowlist of trusted origins. Never reflect the Origin header without validation when credentials are involved.
Related Security Checks
Related Tool
CORS Checker
Run all 6 related checks with our free cors checker
Check Your Website Now
Run a free security scan to check for Access-Control-Allow-Origin issues and 58+ other security vulnerabilities.
Scan Your Website Free