How to fix CORS with Access-Control-Allow-Origin: *
Access-Control-Allow-Origin: * lets any website read your server's responses that need no sign-in. The bigger danger is a server that echoes back any requesting origin and also allows credentials — then a malicious site can read a signed-in user's data. The fix for both: an explicit list of the origins you trust.
How to fix it
Your web server
Where: wherever you set CORS (server config or app code)
Replace Access-Control-Allow-Origin: * with an explicit allowlist, e.g. Access-Control-Allow-Origin: https://yourdomain.com
A wildcard `*` lets any website read authenticated responses. Name the exact origins you trust instead.
How to confirm: Re-scan — the CORS wildcard finding should clear.
Not sure your site needs this fix? A scan checks this and dozens of other things and shows what yours is missing.
Scan your site free