How do I check if a URL supports CORS?
Enter the URL you want to test and click 'Check CORS'. The tool sends a simulated cross-origin preflight request – and, optionally, an actual request – from a chosen origin and reports back on which cross-origin access the server permits.
What is CORS?
Cross-Origin Resource Sharing (CORS) is a browser security mechanism that blocks a web page from making requests to a different origin (domain, protocol or port) unless the server explicitly allows it via Access-Control-* response headers. Without these headers, browsers block the response from reaching the calling page's script, even if the server processed the request.
What does this tool check?
It reports whether the tested origin is allowed via Access-Control-Allow-Origin, whether the chosen HTTP method is listed in Access-Control-Allow-Methods, whether any custom headers you specify are listed in Access-Control-Allow-Headers, whether credentials are allowed, and whether the response varies safely by origin.
What is a CORS preflight request?
For requests that aren't 'simple' (e.g. using methods other than GET/POST, or custom headers), browsers first send an OPTIONS request asking the server for permission before sending the real request. This tool always sends that preflight request, and can optionally send the real request afterwards too.
Why is a wildcard origin with credentials flagged as an issue?
The CORS specification forbids combining Access-Control-Allow-Origin: * with Access-Control-Allow-Credentials: true – browsers will reject the response outright. A server returning this combination usually indicates a misconfiguration that should be fixed, typically by reflecting a specific allow-listed origin instead of using a wildcard.
What does the 'Vary: Origin' warning mean?
When a server returns a specific origin in Access-Control-Allow-Origin rather than a wildcard, it should also send Vary: Origin so that shared caches (like CDNs) don't serve a response meant for one origin to a different one.
Can I test custom request headers?
Yes. Open the 'Settings' panel and list any headers your request would send (e.g. Authorization, Content-Type) – the tool includes them in the preflight's Access-Control-Request-Headers and checks whether each is echoed back as allowed.
Does 'not allowed' always mean something is broken?
Not necessarily. Many APIs intentionally restrict cross-origin access to specific origins. This tool reports what the server actually permits so you can confirm it matches what you intended – whether that's wide open, tightly restricted, or somewhere in between.
Does this tool store the URLs I check?
No. Checks are performed on demand and results are only shown in your browser – nothing is saved.