Matan · Security · Headers

CORS (ACAO) (Security)

Access-Control-Allow-Origin: * on a credentialed or sensitive response lets any origin read it.

Pass condition in our engine: Access-Control-Allow-Origin is not *.

This Security check is part of SEO-GEO scoring 2.2.1, last updated 2026-09-18. About 90 percent of the evaluation runs on the HTML we crawl, so you can verify the same pass condition with a free report.

1. Problem description

Wildcard ACAO is fine for truly public, cacheable APIs. It is not fine for sessions or personal data. We fail when ACAO is exactly *.

2. Most common causes

  • A CDN default for API routes.
  • A debug flag left on.

3. How to fix it

  1. Echo a specific origin instead of *.
  2. Never combine * with Access-Control-Allow-Credentials: true.
  3. Keep CORS off entirely for same-origin HTML pages.

Test this check

We fetch only this URL (plus robots.txt / llms.txt at the domain root when the check needs them). We do not crawl the rest of the site like a full report.

Scoring rules for the full site crawl are documented in methodology. Want every category at once? Generate a free report.

Get your free website audit

Enter your URL and receive a full audit with scoring and recommendations. No sign-up required.

Analyze My Website — FreeView sample report