How do I check a website's CORS headers?

Enter the URL in the CORS Headers Checker to inspect its Access-Control-Allow-Origin and related CORS response headers.

Cross-Origin Resource Sharing (CORS) is a browser security mechanism where servers use HTTP headers to declare which origins may read their responses via scripts, protecting users from malicious cross-site data access.

Why is my fetch blocked by CORS policy?

The browser blocks the response when the server's Access-Control-Allow-Origin header does not include your page's origin (or when preflight requirements fail). The server must explicitly allow your origin.

Is Access-Control-Allow-Origin: * safe?

A wildcard is acceptable for public, credential-free resources, but combined with Access-Control-Allow-Credentials: true it is dangerous and disallowed by browsers — the server should echo a specific trusted origin instead.

WEBSITE SECURITY TOOLS · FREE ONLINE TOOL

CORS Headers Checker

Send a real preflight and see exactly who can read your resources cross-originYour app works on localhost, then every API call fails in production: nine times out of ten it is a CORS misconfiguration. Paste any URL and see exactly what the server is declaring, header by header.

✓ Free to use✓ No sign-up✓ Ready in your browser

// CORS HEADERS CHECKER · GET STARTED

Use CORS Headers Checker

Send a real preflight and see exactly who can read your resources cross-origin

// CORS HEADERS CHECKER · AT A GLANCE

CORS Headers Checker: what to know first.

Send a real preflight and see exactly who can read your resources cross-origin

01
CORS errors are among the most confusing failures in web development: the request works in curl, works in Postman, and fails in the browser with a cryptic console message. The CORS Headers Checker reproduces the exact preflight handshake the browser performs, sending an OPTIONS request with an Origin and reading back every Access-Control header the server returns.
02
The analysis distinguishes the cases that matter: wide-open wildcard access, properly restricted origins, missing headers, and the classic misconfiguration of a wildcard origin combined with credentials. Each finding explains what the browser will do with the response, so the fix is obvious.

// CORS HEADERS CHECKER · HOW IT WORKS

How to use the CORS Headers Checker

Enter URL

Enter the resource URL to test (e.g. https://example.com/api/data).

Send preflight

Optionally set the Origin to test from, then click "Check CORS Headers".

Review verdict

Review the preflight result, the verdict, and any misconfigurations.

// CORS HEADERS CHECKER · ABOUT THIS TOOL

About the CORS Headers Checker

CORS errors are among the most confusing failures in web development: the request works in curl and fails in the browser. The CORS Headers Checker reproduces the browser's preflight handshake and reads back every Access-Control header.

Each finding is explained in plain language, distinguishing wide-open access from properly restricted origins, so the fix is obvious.

Where it helps most

The moments CORS blocks real work.

Debugging blocked fetch

See the exact header values behind a blocked request instead of guessing at the configuration.

Pre-launch API checks

Verify the right origins are exposed on staging and production before a partner integration ships.

Locking down APIs

Hunt for policies that hand out access too freely and tighten them before attackers notice.

Fixing preflight failures

Catch missing preflight responses that break PUT, DELETE, and JSON requests.

Reading the report

What the findings actually mean.

Wildcard plus credentials

Browsers reject Access-Control-Allow-Origin: * combined with credentials outright; the server must echo the specific origin.

Watch preflight caching

Without Access-Control-Max-Age, browsers re-run the OPTIONS check on every complex request, adding needless latency.

Check Vary: Origin

This header stops caches from serving one origin's CORS response to another, a subtle bug the report covers.

CORS Headers Checker: built for trust

Findings come back in plain language you can hand straight to whoever owns the server configuration. No signup, results in seconds.

// CORS HEADERS CHECKER · COMMON QUESTIONS

CORS Headers Checker FAQs

What is CORS and why do browsers enforce it?

CORS is the browser security mechanism that controls which websites can read responses from your API. It exists so a malicious site cannot silently make requests to your bank or email account on your behalf. Browsers enforce the rules; servers just declare the policy through headers.

Why is my fetch request blocked by CORS?

What does Access-Control-Allow-Origin: * mean?

Can I use a wildcard origin together with Access-Control-Allow-Credentials?

Do all requests trigger a preflight OPTIONS check?

tools-guide

Security Headers Checker: Grade Your Site's Defenses

Free security headers checker. Instantly scan HSTS, CSP, X-Frame-Options and more on any site, get an A to F grade and clear steps to fix every website gap.

Read article →