Stop allowing powerful features for every origin on Shopify
Why it matters
A feature set to * can be passed to any embedded site you give an allow attribute, such as an ad frame. Restrict it to your origin or named partners.
Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.
The fix
Not possible on Shopify. Shopify sets the storefront's response headers and stores cannot change them.
Related
Scan your domain to see whether this applies to you.