CORS Checker
Check whether a URL's CORS (Cross-Origin Resource Sharing) headers would let a browser at a given origin read its response. This inspects the actual Access-Control-* headers the server returns, and separately runs a real fetch from this page to show what your own browser experiences.
Frequently asked questions
Why are there two separate results?
The header inspection (run from our server) shows exactly what the target server sent back when asked about a specific origin. The live browser test shows what actually happens when this page — running at its own real origin — tries to fetch that URL, which is the same mechanism any website hitting that API would face.
The server says it would allow my origin, but the browser test failed — why?
This can happen for requests that trigger a CORS preflight (like ones with custom headers or non-simple methods) if the server handles the preflight OPTIONS request differently from a plain GET, or if credentials mode requirements aren't met even when Allow-Origin is permissive.
What does 'Access-Control-Allow-Origin: *' mean?
It means the server allows any origin to read the response — useful for public APIs, but it can't be combined with credentialed requests (cookies), which require an explicit origin plus Access-Control-Allow-Credentials: true.