Limit CORS to the origins that need it on WordPress

Why it matters

The server echoes any Origin, so every website can read these responses from a visitor's browser, which matters as soon as a response holds anything not meant for everyone. A fixed allow-list, or no CORS headers at all when nothing needs them, keeps that in check.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Stage 1: find the plugin, theme code or server rule that adds Access-Control-Allow-Origin to normal pages.
2. Stage 2: remove it, or limit it to the origins that need it; then clear caches.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the CORS policy check
• Replace CORS origin reflection with an allow-list
• Never allow the null origin in CORS
• Drop credentials or the wildcard from CORS