Can other websites read your pages? (CORS)
Whether your site tells browsers that any other website may read its responses, including when the visitor is signed in.
Why it matters
Browsers normally stop one website reading another website's responses. CORS headers relax that rule. If your site reflects back whatever origin asks and also allows credentials, a page on any other site could read what your signed-in users see.
How a survey checks it
Passive check: part of every free survey.
We send one ordinary request for your homepage with an Origin header naming a site that cannot exist, and read the CORS headers in the answer. We never send cookies or sign in.
How to fix it
- Only send CORS headers on the addresses that really need them, usually your API, not your pages.
- List the exact origins you trust instead of echoing back whatever the request names.
- Never combine Access-Control-Allow-Credentials with an open or reflected origin.
Prefer us to do it? Ask for a fix quote
Common questions
Is Access-Control-Allow-Origin: * dangerous?
On its own it lets any site read public responses, which is often fine for public data. It becomes a problem combined with credentials, or on responses that hold anything private.
Does this check my API too?
The free survey checks your homepage. Once you verify ownership, the verified checks also test the API addresses your app calls.