CORS headers on your pages: Crawl Audit check 155

Short answer: CORS lets a server say which other websites' scripts may read its responses. The wildcard * means any site can. That's fine for public content and wrong for anything tied to a login. Check 155 warns when your homepage sends Access-Control-Allow-Origin: *.

What Crawl Audit checks

• Pass: no Access-Control-Allow-Origin header, or one naming a specific site.
• Warning: the header is *.

It only looks at your homepage. The responses that matter most are usually API routes and anything that returns a signed-in visitor's data.

What the sources say

• OWASP: "If you don't use this header, your site is protected by default by the Same Origin Policy (SOP)."
• OWASP: "If you use it, set specific origins instead of *." It adds that a public API meant for any site "might" need *.
• MDN: "For requests without credentials, the literal value * can be specified as a wildcard. Attempting to use the wildcard with credentials results in an error."

When the wildcard is fine

• Fine: public pages, fonts, images, and public data feeds that need no login.
• Not fine: anything that depends on cookies or tokens, or returns data for one person. Name the allowed sites instead.

When a request carries cookies, browsers won't let a script read a response marked *. So on a public page, the wildcard only exposes what anyone could already see by visiting it.

On devmarde.com

Our homepage sent Access-Control-Allow-Origin: * on 6 October, so this check warns for us. Our pages are public and need no login, so we've left it as it is.

Sources

• OWASP, HTTP Headers Cheat Sheet.
• MDN, Access-Control-Allow-Origin, checked 6 October 2026.