Origin
Match the page scheme, host and port.
CORS Checker
CORS Checker
Test simple requests, OPTIONS preflight, credentials, methods and headers for a specific Origin.
Example: The tool sends safe GET and OPTIONS requests only. It performs no writes and stores no history.
CORS result
No check started
Enter a public resource URL and request Origin to inspect cross-origin and preflight behavior.
CROSS-ORIGIN ACCESS
What is Cross-Origin Resource Sharing (CORS)?
CORS is a browser-enforced access policy. A server uses Access-Control-Allow-* response headers to state which page Origins, methods, headers and credential modes may read a resource.
CORS is not server-side authentication and does not stop non-browser clients from sending requests. It controls whether a browser exposes a cross-origin response to page scripts.
Preflight
Approve methods and request headers.
Least privilege
Expose resources only to trusted Origins.
Why check CORS configuration?
CORS can be modified by a CDN, API gateway, reverse proxy and application framework. A mistake in allowlist logic, caching or preflight handling can break clients or expose sensitive data to an untrusted Origin.
Find cross-origin failures
Compare GET and OPTIONS to isolate Origin, method and header authorization issues.
Detect excessive access
Identify arbitrary Origin reflection and unsafe wildcard/credential combinations.
Verify cache behavior
Check Vary: Origin to reduce authorization mix-ups in shared caches and CDNs.
How does the CORS checker work?
The checker models the browser handshake without sending business requests that could modify target data.
- 01
Validate the public target
Block local, private and reserved addresses and validate GET redirects.
- 02
Send a simple GET
Attach the selected Origin and read the real CORS response headers.
- 03
Probe Origin reflection
Use an independent probe Origin to detect unconditional reflection.
- 04
Simulate OPTIONS preflight
Test the chosen method and headers without sending a write request.
How to interpret CORS results
Interpret the result in context. A normal page or same-origin-only API may correctly omit CORS headers. A blocked result is a functional problem only when another browser Origin is expected to read the resource.
Allowed
GET and preflight pass for the selected Origin; confirm that the Origin is genuinely trusted.
Blocked / partial
The browser cannot complete every request; first confirm that cross-origin access is required.
Risky configuration
Origin reflection or a credential combination needs prompt allowlist tightening.
CORS checker FAQ
Is a missing Access-Control-Allow-Origin a website failure?+
No. Normal pages and same-origin-only APIs often need no CORS. It becomes a functional issue only when a browser page from another Origin must read the response.
Does CORS directly improve SEO rankings?+
No. CORS headers are not a general ranking bonus. Correct configuration can support working front-end resources, but it does not replace crawlable HTML, strong content or performance.
Can Access-Control-Allow-Origin contain several domains?+
Not as a comma-separated list. Validate the request Origin and return one approved Origin per response, together with Vary: Origin.
Why test OPTIONS preflight?+
Non-simple methods, custom headers and some content types trigger OPTIONS first. A successful GET header does not help when preflight fails.
Why can credentials not be used with a wildcard?+
Browsers reject Access-Control-Allow-Origin: * in credential mode. Return an explicit trusted Origin when cookies or authorization credentials are required.
Related webmaster tools
Continue with security headers, SSL, HTTP response and DNS checks.
HTTP security headers checker
Check CSP, HSTS, framing and browser permission policies.
SSL/TLS certificate checker
Check certificate expiry, hostname and TLS protocol.
HTTP status checker
Inspect final status, redirects and search headers.
DNS lookup
View records, IP addresses and response time across probes.