Checks for overly permissive CORS settings that could expose your API to unauthorized access.
This check examines the `Access-Control-Allow-Origin` response header for overly permissive settings. A wildcard (`*`) CORS policy allows any website to make cross-origin requests to your site, while reflecting the requesting origin without validation can expose sensitive data.
CORS controls which external domains can make requests to your server. An overly permissive policy can allow malicious websites to read data from your API endpoints, steal user credentials, or perform unauthorized actions on behalf of your users.
Misconfigured CORS can expose private APIs, user data, and internal resources to unauthorized third-party websites. This is especially dangerous for authenticated endpoints that return sensitive user information.
Run a free audit to see how your site performs on CORS Misconfiguration Check and 159 other checks.
Start Free AuditVerifies the validity and configuration of the SSL certificate.
Checks if the site is secured with a valid SSL certificate.
Ensures that HTTP traffic is automatically redirected to HTTPS.
Checks for insecure (HTTP) resources on a secure (HTTPS) page.