Resources are shared with every origin, without credentials
What this check looks for
This endpoint tells every website it may read the response, and no cookies are involved. That is the normal, correct setting for something meant to be public.
Why it matters
Nothing is wrong. It is reported so you can confirm it was deliberate: a public API, a font, or a CDN asset should say exactly this, while an endpoint that returns anything user-specific should not.
What it costs your score
This check never deducts. It reports a fact — or reports that something could not be verified — and is shown on the report without moving the score.
- Severity
- info
- Default confidence
- confirmed
- Status when triggered
- info
- Deduction
- 0 points
- Family cap
- none
- Category
- Web security
- Module
- Web cors
- Fix owned by
- user
- In the ruleset since
- 2026.09
Technical detail
Access-Control-Allow-Origin: * on the response from ‹origin›, with no Access-Control-Allow-Credentials. This is the intended shape for a public resource, and it is better than an allow-list for one: it is a single static value, so it caches cleanly and needs no Vary: Origin.
The wildcard also carries a built-in safety property — browsers refuse to use it for a credentialed request, so cookies are never attached and the response another site reads is the anonymous one. That is what makes it a safe answer for public data and an unsafe answer for anything else.
Worth confirming, since only this one URL was checked: is everything served under this policy genuinely public? A wildcard set once at the server or CDN level tends to cover far more than the asset it was added for, and an endpoint whose response differs per visitor has no business carrying it. If some routes need to be shared with named sites and others do not, scope the header to the routes rather than to the whole host.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.
Other web cors checks
- The CORS policy accepts any request header from any origin
- The Access-Control-Allow-Origin value is not a valid origin
- The CORS policy grants broad methods on an unrestricted origin
- The null origin is on the CORS allow-list
- Any website is allowed to read this site's responses
- Any website can read authenticated responses from this site
- Preflight results are not cached
- The CORS response varies by origin but is not marked Vary: Origin
- The CORS policy pairs a wildcard origin with credentials