CORS allows all origins (wildcard) — the fix
This site sends Access-Control-Allow-Origin: * which allows any website to make cross-origin requests to your server and read the responses.
Where this fits: security in SEO
Security issues erode both rankings and trust. HTTPS has been a ranking signal since 2014, and browsers actively warn users away from insecure or mixed-content pages — a warning interstitial is a 100% bounce rate. Missing security headers rarely block indexing, but they widen your attack surface, and a hacked site (injected spam, malicious redirects) can be removed from results entirely. Security is the SEO work you do so you never have to do recovery work.
Why cors allows all origins (wildcard) hurts your rankings
A wildcard CORS policy allows any malicious website to make authenticated requests to your API and read the responses, potentially exposing user data. While fine for truly public resources (CDN assets, public APIs), it is dangerous for authenticated endpoints. Security breaches can lead to Google Safe Browsing warnings and dramatic traffic loss.
This is a medium-severity issue: individually modest, but it compounds — dozens of medium issues across hundreds of pages add up to a real quality deficit in how search engines assess the site.
How to fix it
Replace the wildcard (*) with specific allowed origins. Implement a whitelist of trusted domains and dynamically set the Access-Control-Allow-Origin header based on the request origin. For public resources that genuinely need universal access, consider whether credentials should be restricted.
Security best practices
- Serve everything over HTTPS and redirect HTTP with a single 301.
- Send HSTS, X-Content-Type-Options, and a Content-Security-Policy on every response.
- Eliminate mixed content — one insecure asset breaks the padlock.
- Keep dependencies and CMS plugins patched; most site hacks are known-CVE exploits.
- Monitor Search Console's security section — Google often knows you're hacked before you do.
The full library: SEO best practices, by category.
Frequently asked questions
What does "CORS allows all origins (wildcard)" mean?
This site sends Access-Control-Allow-Origin: * which allows any website to make cross-origin requests to your server and read the responses.
Why does cors allows all origins (wildcard) matter for SEO?
A wildcard CORS policy allows any malicious website to make authenticated requests to your API and read the responses, potentially exposing user data. While fine for truly public resources (CDN assets, public APIs), it is dangerous for authenticated endpoints. Security breaches can lead to Google Safe Browsing warnings and dramatic traffic loss.
How do I fix cors allows all origins (wildcard)?
Replace the wildcard (*) with specific allowed origins. Implement a whitelist of trusted domains and dynamically set the Access-Control-Allow-Origin header based on the request origin. For public resources that genuinely need universal access, consider whether credentials should be restricted.
How serious is this issue?
This is a medium-severity issue: individually modest, but it compounds — dozens of medium issues across hundreds of pages add up to a real quality deficit in how search engines assess the site. It belongs to the security family of checks.
How do I find every page affected by this on my site?
Run a free Dr Urls audit: it crawls your site, detects cors allows all origins (wildcard) on every affected page, shows example URLs, and generates a ready-to-use fix task. Re-scan after fixing to verify the issue is gone.
Does your site have this issue?
A free Dr Urls audit crawls your site, finds every page affected by cors allows all origins (wildcard), and hands you a ready-made fix task.
Check my site free