Website · Fix guide
Cross-origin protections
- CORS
- Cross-Origin Resource Sharing
- CORP
- Cross-Origin Resource Policy
CORS and CORP control which other origins may read or embed web resources.
What does this test measure?
CORS and CORP control which other origins may read or embed web resources.
What to do next
- Avoid combining credentialed requests with unrestricted origins.
- Set explicit origins where private responses are shared.
- Use Cross-Origin-Resource-Policy where resources should be restricted.
Useful links
How to verify the fix
Test real cross-origin application flows from both allowed and untrusted origins.
When this result may be wrong
Public assets and APIs may deliberately allow every origin, so headers need application context.
Ready to check again?
Check a domain
Run a fresh report after DNS caches and platform changes have had time to update.