diff --git a/h5bp/directive-only/cross-domain-insecure.conf b/h5bp/directive-only/cross-domain-insecure.conf
index 301886d..e9373ad 100644
--- a/h5bp/directive-only/cross-domain-insecure.conf
+++ b/h5bp/directive-only/cross-domain-insecure.conf
@@ -1,5 +1,7 @@
 # Cross domain AJAX requests
 
+# http://www.w3.org/TR/cors/#access-control-allow-origin-response-header
+
 # **Security Warning**
 # Do not use this without understanding the consequences.
 # This will permit access from any other website.
@@ -10,6 +12,3 @@ add_header "Access-Control-Allow-Origin" "*";
 #
 # Allow access based on [sub]domain:
 #    add_header "Access-Control-Allow-Origin" "subdomain.example.com";
-# OR
-#    add_header "Access-Control-Allow-Origin" "*.example.com";
-