Header Security
CORS Configuration Check (Access-Control-Allow-Origin)
CORS allows you to control which origins can access your resources. Learn how to detect a permissive (*) configuration and restrict it to protect your data.
What this test checks
This test checks the configuration of the Access-Control-Allow-Origin header. A value of '*' allows all origins, which can expose your APIs, user data, or sensitive files to cross-origin attacks (CSRF, data theft). A restrictive configuration is essential for modern web application security.
Our recommendation
Limit the use of Access-Control-Allow-Origin to specific domains. If you use APIs, explicitly define allowed origins (e.g., 'Access-Control-Allow-Origin: https://your-domain.com'). Avoid using '*' in production unless you have a valid reason (e.g., public API). Also check Access-Control-Allow-Methods and Access-Control-Allow-Headers headers to restrict allowed methods.
Security tests
Read more
CMS Security