How to fix a wildcard CORS policy
Access-Control-Allow-Origin * on a page lets any site read its response. Only APIs meant to be public should use it.
Step by step, with screenshots: Access-Control-Allow-Origin: what CORS allows and when * is dangerous →
Check your own site
Runs this check and the other 192, free, in about 45 seconds.
Or run only this check with the free Security headers checker.
What it is
CORS (Cross-Origin Resource Sharing) is a set of HTTP headers that tells a browser whether JavaScript running on one website may read responses from another. The key header is Access-Control-Allow-Origin, which names the sites allowed to read the response; * means any site.
A wildcard is fine for truly public files, such as web fonts, open APIs and public images. On an HTML page it lets any website fetch and read that page through a visitor's browser, which exposes content that depends on where the visitor is, such as intranet or IP-restricted pages, and often signals a loose configuration elsewhere. getReport flags Access-Control-Allow-Origin: * on the page itself. A page is OK when it sends no CORS header or names only the origins that need access.
What a passing site looks like
- Access-Control-Allow-Origin is not a wildcardwarning · −2 ptseffort S
Access-Control-Allow-Origin is * on the page itself
Why it matters. A wildcard lets any website read this response from inside a visitor's browser. Harmless for public files, risky for pages that differ per user, and dangerous when credentials are allowed too.
- Send Access-Control-Allow-Origin only on API responses that need it, with the exact origin instead of *.
- Never combine * with Access-Control-Allow-Credentials: true.
Questions people ask
What does Access-Control-Allow-Origin: * mean?
It tells browsers that JavaScript on any website may read this response. Browsers still refuse to send cookies or other credentials with such a request, so the reading site gets what an anonymous visitor would get. That makes * suitable for public resources and wrong for anything private or limited by network location.
What does "No 'Access-Control-Allow-Origin' header is present on the requested resource" mean?
It is a browser error shown when a script on one site tries to read a response from another site that did not allow it. The request reached the server, but the browser hid the response. The fix belongs on the server being called: add Access-Control-Allow-Origin naming your site. Setting * just to silence the error opens the response to every site.
Why can't I use a wildcard origin with credentials?
Because browsers forbid it: when a response includes Access-Control-Allow-Credentials: true, Access-Control-Allow-Origin must name one exact origin, not *. The risky workaround is a server that copies whatever Origin it receives into the header, which lets any site read logged-in visitors' data. Keep an allowlist of trusted origins and echo back only those.
How do I allow multiple origins in Access-Control-Allow-Origin?
The header accepts only one origin, so the server checks the request's Origin against an allowlist and returns that origin when it matches. Add Vary: Origin so caches keep a separate copy for each origin. In nginx this is usually done with a map block, and most frameworks have CORS middleware that takes a list of allowed origins.