# How to fix a wildcard CORS policy

> Access-Control-Allow-Origin * on a page lets any site read its response. Only APIs meant to be public should use it.

Security · HTML version: https://getreport.app/learn/cors

## Wildcard CORS header

Passing looks like: Access-Control-Allow-Origin is not a wildcard.

**Why it matters.** A wildcard lets any website read this response from inside a visitor's browser. Harmless for public files, risky for pages that differ per user, and dangerous when credentials are allowed too.

**How to fix it.**

1. Send Access-Control-Allow-Origin only on API responses that need it, with the exact origin instead of *.
2. Never combine * with Access-Control-Allow-Credentials: true.

Check your own page: https://getreport.app/