Free CORS Misconfiguration Checker
A permissive Cross-Origin Resource Sharing policy can let any website read your authenticated responses. We send a request with an arbitrary Origin and check whether the server reflects it back, and whether it also allows credentials, the combination that enables cross-origin data theft.
Origin Reflection
We detect servers that blindly echo whatever Origin is sent into Access-Control-Allow-Origin, effectively trusting every website.
Credentialed CORS
Reflection combined with Allow-Credentials: true is critical, any site could read responses tied to a logged-in user's session.
Clear Severity
Findings are rated by impact, and a public wildcard (without credentials) is correctly treated as normal, not a false alarm.
What is a CORS misconfiguration?
CORS controls which origins may read responses from your server. The dangerous pattern is a server that reflects the request's Origin and sets Allow-Credentials: true. This lets a malicious site make authenticated requests on a victim's behalf and read the results, exposing private data.
A policy that doesn't reflect arbitrary origins is reported as safe.
Frequently Asked Questions About CORS Misconfiguration
What is a CORS misconfiguration?
Cross-Origin Resource Sharing (CORS) controls which other websites are allowed to read responses from your server. A misconfiguration occurs when the server is too permissive, most dangerously when it reflects whatever Origin a request sends and also sets Access-Control-Allow-Credentials: true. That combination lets any website read responses tied to a logged-in user.
How does this CORS checker test my site?
We send a request carrying an arbitrary, attacker-style Origin header and inspect the response. If the server echoes that Origin back in Access-Control-Allow-Origin, it is reflecting arbitrary origins. We then check whether credentials are also allowed, and rate the finding by severity based on the combination.
Is Access-Control-Allow-Origin: * dangerous?
A bare wildcard on its own is usually fine, it is how public, unauthenticated APIs and assets are meant to be shared, and browsers refuse to combine a wildcard with credentials. That is why we do not flag a plain wildcard as a vulnerability. The dangerous cases are arbitrary-origin reflection, or a wildcard combined with credentials.
What is the real-world risk of a CORS misconfiguration?
If a site reflects arbitrary origins and allows credentials, a malicious page a victim visits can make authenticated requests to the vulnerable site and read the responses, exposing private account data, tokens, or internal API results. It is effectively a cross-origin data-theft channel.
Is the CORS checker free?
Yes, it is free with no registration. For a broader audit covering cookie security, Content-Security-Policy effectiveness, security headers, and SSL/TLS, run a full ScanTower scan from the link below.
More HTTP security tools
Security Headers Checker
Audit CSP, HSTS and other HTTP security headers.
CSP Checker
Evaluate Content-Security-Policy effectiveness, unsafe-inline, wildcards and missing directives.
Cookie Security Checker
Audit cookies for Secure, HttpOnly and SameSite flags.
Subresource Integrity Checker
Verify SRI hashes and find third-party resources missing integrity protection.
HTTP Security Checker
Test HTTP to HTTPS redirects and catch protocol downgrade risks.
That's Just the Beginning
FREEThis CORS Check scan caught some issues. Run a Full Security Scan to uncover hidden threats like exposed secrets, malicious scripts, and supply chain attacks this quick check missed.