I want to use a function like this to allow access to the feeds from a variety of services but my knowledge of the security implications is limited. I think I'm being safe by limiting the access to feeds.

What are the dangers (if any) I'm creating if I do this?

add_action( 'pre_get_posts', 'add_header_origin' );

function add_header_origin() {
    if (is_feed()){
        header( 'Access-Control-Allow-Origin: *' );

3 Answers 3


You need to have a super great reason to disable CORS, as no real reason was given here the answer should be "do not do it, it is not secure".

You assume that no one can craft a feed link which will give him a write access. This might be true, but you should not open holes in your security based on "assuming".

In the very least, if some other domain needs "AJAX" access to your feeds, you should disable CORS only for that specific domain.

In addition pre_get_posts is totally the wrong place to do it, and you should do it on init. The way your code is currently written it may disable CORS for pages which are not feed.


I read this post as saying that as long as I'm not requiring login credentials (I'm not) that all is well.


Please be aware that setting Access-Control-Allow-Origin: * only instructs browsers if they're supposed to consume the response. That header has no effect on requests made server side (curl, python, node) regardless of this setting.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.