Limit CORS to the origins that need it on Shopify
Why it matters
The server echoes any Origin, so every website can read these responses from a visitor's browser, which matters as soon as a response holds anything not meant for everyone. A fixed allow-list, or no CORS headers at all when nothing needs them, keeps that in check.
Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.
The fix
Not possible on Shopify. Shopify sets the storefront's response headers and stores cannot change their CORS policy.
Related
Scan your domain to see whether this applies to you.