devpack
EnglishDeutschFrançaisEspañolPortuguês (Brasil)
Site Audit

CORS Tester — Debug CORS Errors

Blocked by a CORS error? Enter the API address and your site’s origin. We’ll send the same requests a browser would, show exactly what fails, and give you the server fix.

Updated

This tool fetches the public URL you enter from our server. Results are held in temporary memory for a few minutes and never stored in a database.

How to use the CORS Tester

  1. Enter the API address that’s failing, and your site’s address as the origin.
  2. Choose the method and add any custom headers, such as Authorization.
  3. Tick Send cookies if your request uses credentials, then click Test CORS.
  4. Read what failed, then copy the fix for your server.

What is CORS?

Browsers stop a page on one site from reading responses from another, unless that other server agrees. Cross-Origin Resource Sharing is how it agrees, using Access-Control-Allow-* response headers. It must be fixed on the server, not in your front-end code.

What is a preflight?

For some requests, such as PUT, DELETE or those with an Authorization header, the browser first sends an OPTIONS request to ask permission. If that fails, the real request never happens.

Common CORS errors

  • No Access-Control-Allow-Origin header: the server didn’t add CORS headers. Error pages often leave them out too, so check that your request isn’t failing for another reason.
  • Wildcard with credentials: * can’t be used with cookies. Send the exact origin.
  • Preflight fails: your server must answer OPTIONS with a 2xx status, before any login check.
  • Multiple values: two layers, such as a proxy and an app, may each be adding the header.

Keep it safe

Only allow origins you trust. Don’t copy the incoming Origin header back without checking it against a list, especially with credentials, because any site could then read your users’ data.

Want to build the headers from scratch? Use the CORS Header Generator. To inspect a full response, try the HTTP Header Checker.

Also searched as: cors checker, test cors, cors error, blocked by cors policy, access-control-allow-origin checker, cors preflight test, no access-control-allow-origin header.

Tools that pair well with the CORS Tester

  • API Tester — A lightweight Postman alternative in your browser: build an HTTP request, send it and inspect status, timing, headers and pretty-printed JSON.
  • Security Headers Checker — Grade a site’s HTTP security headers from A+ to F, see which are missing and why they matter, and copy ready-made config snippets for Nginx, Apache, Netlify, Vercel or Cloudflare.
  • HTTP Status Codes — Every standard HTTP response code explained in plain English, with when to use it and how it affects SEO.
  • Email Header Analyzer — Paste the raw headers of an email to see its whole journey: every server hop with the time it took, the SPF, DKIM and DMARC results, the originating IP, and warning signs like a mismatched Reply-To or Return-Path.

Frequently asked questions

Why does my API work in Postman but not in the browser?
CORS is enforced by browsers. Postman doesn’t apply it, so the same request can work there and still fail on your site.
Can I fix CORS from the front end?
No. The server has to send the headers. If you don’t control it, call it through your own backend.
Is Access-Control-Allow-Origin: * safe?
It’s fine for public data that needs no login. Don’t use it for private data.
Is this test the same as a real browser?
It sends the same style of requests from our server and applies the browser’s rules. Results can differ if your server treats visitors or locations differently.

Related tools

apiCORS Header Generator & TesterSeeing “has been blocked by CORS policy”? Describe who may call your API — origins, methods, headers,…apiHTTP Header CheckerFetch any URL and see exactly what the server sends back — status code, redirect chain and every response…apiAPI TesterA lightweight Postman alternative in your browser: build an HTTP request, send it and inspect status,…apiSecurity Headers CheckerGrade a site’s HTTP security headers from A+ to F, see which are missing and why they matter, and copy…localHTTP Status CodesEvery standard HTTP response code explained in plain English, with when to use it and how it affects SEO.…localEmail Header AnalyzerPaste the raw headers of an email to see its whole journey: every server hop with the time it took, the…