- Home
- The 17 checks
- Any website can call your API
🌐 Website safety · Nice to fix (SEV-3)
Any website can call your API
In plain English: CORS is the setting that says which websites can talk to your app's server from a browser. Yours says "any website", so other sites can call your server.
What happens if you ship it
Another site calls your endpoints from its own pages, and you never see it in your logs as a problem.
How to fix it technical
Replace the wildcard with the exact origins of your app.
Let your AI tool fix it
Paste this into Lovable, Bolt, Cursor, Replit or Claude Code:
Prompt for your AI tool
Fix this problem in my project: Any website can call your API. Replace the wildcard with the exact origins of your app. Change only what this fix needs, then tell me what you changed and anything I have to do myself.Check your app
Run npx sigship in your project folder. It reports this problem as cors-wildcard, along with 16 other checks. Nothing leaves your computer. New to the terminal?
Questions
Is Access-Control-Allow-Origin * always bad?
Not for truly public data. For anything tied to a user or that changes data, list the exact web addresses of your own app instead.
What should I put instead of *?
The full address of your site, such as https://yourapp.com, and any other domains you actually use.