Access-Control-Allow-Origin
Specifies which origins are permitted to read the response, the fundamental CORS header.
Syntax
Access-Control-Allow-Origin: * | <origin>Example
Access-Control-Allow-Origin: https://example.comDescription
Access-Control-Allow-Origin is the most important CORS header. Tells the browser which origins can access the response.
Value: specific origin (e.g., https://example.com) or * (any origin). * cannot be used with credentials.
For security, avoid * on sensitive endpoints. Validate the Origin header against an allowlist. Always include Vary: Origin when dynamic.
How real sites send this header
Home-page responses of 503 popular sites from the enterno.io /check catalogue, checked in the last 30 days.
17.1%
(86 of 503) send Access-Control-Allow-Origin.
Most common values:
*— 75 sitesyastatic.net— 2 sites
See it on: beget.com, cnn.com, etsy.com, forbes.com, getbootstrap.com
Check if your website sends this header correctly
Check your headers →