Replace CORS origin reflection with an allow-list on WordPress

Why it matters

The server copies any Origin into Access-Control-Allow-Origin and allows credentials, so any website a logged-in visitor opens can read your responses with their cookies. Only origins on a fixed list should ever get that permission.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. The homepage is not a REST API request, so the reflection comes from a plugin (CORS or headers plugins), theme code that copies $_SERVER['HTTP_ORIGIN'] into a header, or the server or CDN.
2. Stage 1: deactivate or reconfigure the plugin to allow only your own origins, or fix the code to compare against a fixed list. Stage 2: clear caches and test any front end that calls the site.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the CORS policy check
• Never allow the null origin in CORS
• Drop credentials or the wildcard from CORS
• Limit CORS to the origins that need it