Web security
Cross-origin requests restricted (CORS)
Security headers, HTTPS enforcement, cookies and cross-origin rules of the website.
Why it matters
Any website a logged-in user visits can read their account data from your site in the background - personal data, API keys, anything the user can see.
How to fix it
Moderate · a few hours- Replace the reflected Origin with an explicit allowlist of your own front-end origins.
- Never combine a dynamic Access-Control-Allow-Origin with Allow-Credentials: true.
- Reload the web server and re-run the scan to confirm.
nginx (allowlist)
map $http_origin $cors_origin {
default "";
"https://app.example.com" $http_origin;
}
add_header Access-Control-Allow-Origin $cors_origin always;How we test it
The check runs from the public internet as part of every scan, read-only and without touching your data. If it fails, your report shows the evidence that proves it - the record, header, file or banner we observed - together with the fix above, tailored to the issue we found.
Does your domain pass this check?
Run all 97 checks in about a minute. Your first scan is free, with the complete fix for your most urgent finding.
Scan your domain free