Wow, 61% of websites that responded with an Access-Control-Allow-Origin header had a value set to "*". This allows for the website to be access in a cross-domain manner (think XSS, global wild cards in crossdomain.xml, etc).<p>I'm worried to think how site operators will adopt CSP (Content Security Policy) once it starts to gain traction.