Every check ยท Headers
CORS
What it checks
Whether the home page echoes another site's Origin in Access-Control-Allow-Origin, with credentials.
Why it matters
Echoing any Origin with credentials lets every site a visitor opens read what they see here, signed in.
How to fix it
- Allow only your own origins in Access-Control-Allow-Origin, from a fixed list.
- Never send Access-Control-Allow-Credentials: true with an origin taken from the request.
Check a site for this and everything else: snag.page. More on headers: Bot challenge Content-Security-Policy Framing nosniff Referrer policy Software versions End-of-life software Permissions-Policy Cross-Origin-Opener-Policy