📖 What is CORS Checker?
CORS (Cross-Origin Resource Sharing) controls which websites can make requests to your API. This checker tests a URL and shows the CORS headers it returns — Access-Control-Allow-Origin, Allow-Methods, Allow-Headers and Allow-Credentials. Use it to debug "No Access-Control-Allow-Origin header" errors, verify API CORS configuration, or test preflight OPTIONS responses. Everything runs in your browser.
💡 Example
Input
https://api.example.com/data
Output
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST
Access-Control-Allow-Headers: Content-Type
🛠️ Common Use Cases
- Debugging "blocked by CORS policy" errors in browser console
- Verifying API CORS headers after configuration changes
- Testing preflight OPTIONS request responses
- Checking if credentials (cookies) are allowed cross-origin
- Validating CORS setup before deploying frontend-to-API integrations
📝 Essential CORS Headers
Access-Control-Allow-Origin — which origins can access the resource (* or specific domain)Access-Control-Allow-Methods — allowed HTTP methods (GET, POST, PUT, DELETE)Access-Control-Allow-Headers — allowed request headersAccess-Control-Allow-Credentials — whether cookies/auth headers are allowed (true/false)Access-Control-Max-Age — how long preflight results can be cached (seconds)
⚠️ Common Mistakes
- Using * with credentials — browsers reject
Access-Control-Allow-Origin: * when credentials are included. Use the specific origin instead. - Missing preflight handling — non-simple requests (PUT, DELETE, custom headers) trigger an OPTIONS preflight. Your server must respond to OPTIONS requests.
- Forgetting Content-Type header — requests with
Content-Type: application/json require CORS to allow that header explicitly.
❓ Frequently Asked Questions
What does "blocked by CORS policy" mean? ▾
The server did not include the right CORS headers to allow your frontend domain to access it. Check Access-Control-Allow-Origin in the response.
What is a preflight request? ▾
A preflight is an automatic OPTIONS request sent by the browser before non-simple requests (PUT, DELETE, custom headers). The server must respond with appropriate CORS headers.
Can I use * for Allow-Origin? ▾
Yes, but not when credentials (cookies) are included. For credentialed requests, the server must echo the specific requesting origin.
Is my data private? ▾
Yes — all processing runs entirely in your browser. Your data is never sent to any server.
Is this tool free? ▾
Completely free — no login, no usage limits, works offline once loaded.
Yes — completely free, no login required, no usage limits.
Is my data private? ▾
Yes — all processing runs in your browser. Your data is never sent to any server.
Does it work offline? ▾
Yes — once the page is loaded, the tool works without an internet connection.