Free CORS Misconfiguration Checker
A permissive Cross-Origin Resource Sharing policy can let any website read your authenticated responses. We send a request with an arbitrary Origin and check whether the server reflects it back, and whether it also allows credentials, the combination that enables cross-origin data theft.
Origin Reflection
We detect servers that blindly echo whatever Origin is sent into Access-Control-Allow-Origin, effectively trusting every website.
Credentialed CORS
Reflection combined with Allow-Credentials: true is critical, any site could read responses tied to a logged-in user's session.
Clear Severity
Findings are rated by impact, and a public wildcard (without credentials) is correctly treated as normal, not a false alarm.
What is a CORS misconfiguration?
CORS controls which origins may read responses from your server. The dangerous pattern is a server that reflects the request's Origin and sets Allow-Credentials: true. This lets a malicious site make authenticated requests on a victim's behalf and read the results, exposing private data.
A policy that doesn't reflect arbitrary origins is reported as safe.
Frequently Asked Questions About CORS Misconfiguration
What is a CORS misconfiguration?
Cross-Origin Resource Sharing (CORS) controls which other websites are allowed to read responses from your server. A misconfiguration occurs when the server is too permissive, most dangerously when it reflects whatever Origin a request sends and also sets Access-Control-Allow-Credentials: true. That combination lets any website read responses tied to a logged-in user.
How does this CORS checker test my site?
We send a request carrying an arbitrary, attacker-style Origin header and inspect the response. If the server echoes that Origin back in Access-Control-Allow-Origin, it is reflecting arbitrary origins. We then check whether credentials are also allowed, and rate the finding by severity based on the combination.
Is Access-Control-Allow-Origin: * dangerous?
A bare wildcard on its own is usually fine, it is how public, unauthenticated APIs and assets are meant to be shared, and browsers refuse to combine a wildcard with credentials. That is why we do not flag a plain wildcard as a vulnerability. The dangerous cases are arbitrary-origin reflection, or a wildcard combined with credentials.
What is the real-world risk of a CORS misconfiguration?
If a site reflects arbitrary origins and allows credentials, a malicious page a victim visits can make authenticated requests to the vulnerable site and read the responses, exposing private account data, tokens, or internal API results. It is effectively a cross-origin data-theft channel.
Is the CORS checker free?
Yes, it is free with no registration. For a broader audit covering cookie security, Content-Security-Policy effectiveness, security headers, and SSL/TLS, run a full ScanTower scan from the link below.
More HTTP security tools
Security Headers Checker
Audit CSP, HSTS and other HTTP security headers.
CSP Checker
Evaluate Content-Security-Policy effectiveness, unsafe-inline, wildcards and missing directives.
Cookie Security Checker
Audit cookies for Secure, HttpOnly and SameSite flags.
Subresource Integrity Checker
Verify SRI hashes and find third-party resources missing integrity protection.
HTTP Security Checker
Test HTTP to HTTPS redirects and catch protocol downgrade risks.
This is one layer of the scan
FreeThis CORS Check scan covers one category. A full scan adds the checks it does not reach: exposed secrets, malicious scripts, and supply chain risks in your third-party code.