Access-Control-Allow-Origin
Declares which origins may read responses from this endpoint. The dangerous mistake here is reflecting the request origin.
Recommended value
Access-Control-Allow-Origin: (only where cross-origin reads are intended)
What it does
CORS relaxes the same-origin policy. That makes it the one header on this list where the risk is setting it, not omitting it.
Access-Control-Allow-Origin: * on a public, unauthenticated asset is fine. On anything that returns user data it is a serious problem, though browsers do refuse to combine * with credentials.
The genuinely dangerous pattern is reflecting the Origin request header back with Access-Control-Allow-Credentials: true. That permits any site to make authenticated requests as the logged-in user and read the responses. It is common because it is the easy way to make CORS errors go away.
If you need multiple origins, match the request origin against an explicit allowlist and echo it only on a match.
Sites sending this header
Found while scanning 188 well-known sites on 2026-08-04: