CORS policy
What it can report
- ✗ high any Origin is echoed with Allow-Credentials: true How to fix it
- ✗ high Allow-Origin: null with credentials How to fix it
- ! medium Allow-Origin: * with Allow-Credentials: true How to fix it
- ! low any Origin is echoed, no credentials How to fix it
How it counts
The score is computed by fixed rules from the checks that ran, and this check has a weight of 3 within Security. A check that errors or is skipped is shown as "could not check" and left out of the score, never counted as a pass. Fixes and the AI summary are written after scoring and never change it.
Related checks
Scan your own domain and see this check run.