Free tools
CORS Header Checker
CORS header checker. Evaluate Access-Control-Allow-Origin/Methods/Headers/Credentials and estimate whether a request (incl. preflight) is allowed.
Request
Used for preflight checks. Include header names only (not values). Leave blank if you don’t send custom headers.
Response headers
Result
CORS header checker
Paste the relevant Access-Control-* response headers and this tool estimates whether a browser would allow the cross-origin request. It also highlights common pitfalls like credentialed requests with Access-Control-Allow-Origin: *.
When this helps
- Debug “CORS blocked” errors from the browser console
- Validate preflight requirements (methods + headers)
- Check whether cookies/credentials are allowed
How to use
- Enter the browser Origin and intended request method/headers.
- Paste the server’s CORS response headers (or expected values).
- Click Check CORS and review errors/warnings.
Note
This is a deterministic checker, not a network test. Real behavior can differ based on exact requests, redirects, and server behavior.
Frequently Asked Questions
What is CORS?
CORS (Cross-Origin Resource Sharing) is a security mechanism that controls how web pages can request resources from a different domain than the one serving the page. Browsers enforce CORS to prevent malicious sites from accessing sensitive data from other domains without permission.
How do I check if my CORS headers are correct?
Paste your server's CORS headers into the tool, along with the origin making the request and the HTTP method being used. The tool evaluates Access-Control-Allow-Origin, Access-Control-Allow-Methods, Access-Control-Allow-Headers, and Access-Control-Allow-Credentials to determine if the request would be allowed.
What does the preflight check mean?
Preflight requests are OPTIONS requests browsers send before the actual request for certain 'complex' requests (like PUT, DELETE, or requests with custom headers). The tool checks whether your CORS configuration properly handles both the preflight OPTIONS request and the actual request.
Is using * for Access-Control-Allow-Origin safe?
Using * allows any website to access your API, which may be acceptable for public data but is risky for authenticated endpoints. Also, * cannot be used with Access-Control-Allow-Credentials: true. For production, specify exact origins or validate origins against an allowlist.
Why am I still getting CORS errors?
Common issues: missing headers on the server, incorrect header values (typos, wrong format), headers not sent on error responses, missing preflight handling, credentials mismatch, or browser caching preflight results. The tool helps identify which specific requirement isn't met.