CORS allows all origins (wildcard): what it is, why it matters, and how to fix it

This site sends Access-Control-Allow-Origin: * which allows any website to make cross-origin requests to your server and read the responses.

A wildcard CORS policy allows any malicious website to make authenticated requests to your API and read the responses, potentially exposing user data. While fine for truly public resources (CDN assets, public APIs), it is dangerous for authenticated endpoints. Security breaches can lead to Google Safe Browsing warnings and dramatic traffic loss.

Replace the wildcard (*) with specific allowed origins. Implement a whitelist of trusted domains and dynamically set the Access-Control-Allow-Origin header based on the request origin. For public resources that genuinely need universal access, consider whether credentials should be restricted.

This is a medium-severity issue: individually modest, but it compounds — dozens of medium issues across hundreds of pages add up to a real quality deficit in how search engines assess the site. It belongs to the security family of checks.

Run a free Dr Urls audit: it crawls your site, detects cors allows all origins (wildcard) on every affected page, shows example URLs, and generates a ready-to-use fix task. Re-scan after fixing to verify the issue is gone.