Wildcard CORS header (Access-Control-Allow-Origin: *)

What it is

Access-Control-Allow-Origin is set to * (any site). This lets ANY other website's JavaScript read responses from this domain in the visitor's browser — fine for a public API, risky if any response here ever contains private data.

How to fix it

Restrict Access-Control-Allow-Origin to the specific domains that legitimately need it, instead of *. If you're not sure how, install the WordPress Plugin: its Security tab applies fixes like this one automatically.