Security Tools

CORS Header Checker

Check a website's CORS (Cross-Origin Resource Sharing) headers.

Enter a domain to check its CORS (Cross-Origin Resource Sharing) response headers.

More Security Tools

Permissions-Policy Checker Mixed Content Detector Referrer-Policy Checker Security Headers Checker X-Content-Type-Options Checker HTTPS Redirect Checker X-Frame-Options Checker HSTS Checker

JustChecker monitors your security headers continuously and alerts you if any regress.

What Is CORS?

Cross-Origin Resource Sharing lets a server allow web pages on other domains to read its responses. This tool sends a request with an Origin header and shows the Access-Control-Allow-* headers the server returns.

When to Use It

When a browser console shows "blocked by CORS policy".
To confirm an API allows your frontend's domain.
To check an API is not open to every site when it should not be.

How to Use It

Enter the API or website URL.
Review Allow-Origin, Allow-Methods and Allow-Credentials.

Understanding the Result

Access-Control-Allow-Origin: * lets any site read public responses. With credentials (cookies), the server must name the exact origin - * is not allowed together with Allow-Credentials: true.

Limitations

Many APIs only send CORS headers for specific origins or preflight (OPTIONS) requests, so results can differ from what your own frontend receives. CORS is enforced by browsers only - it is not an access-control mechanism for servers.

Frequently Asked Questions

Browsers block a page on one domain from making requests to a different domain's API by default (the same-origin policy) - CORS headers are how a server explicitly opts in to allowing specific other domains to make cross-origin requests to it.

It allows any domain whatsoever to make cross-origin requests to your API - fine for a genuinely public, unauthenticated API, but a real risk if the same endpoint also handles authenticated/sensitive requests via cookies or credentials.

The endpoint working when called directly (e.g. from a server, or Postman) doesn't mean it's configured to allow BROWSER-based cross-origin requests - CORS is a browser-enforced restriction, not a server-side existence check.

For certain request types (like ones using custom headers or non-simple methods), browsers first send an OPTIONS request asking permission before the actual request - your server needs to correctly respond to this preflight, not just the final request.

Not inherently - it depends entirely on what the endpoint does; permissive CORS on a public, read-only API is normal and intentional, while the same permissiveness on a credentialed, sensitive endpoint would be a genuine concern.

No - CORS only affects browser-based, cross-origin JavaScript requests; it provides no protection against direct server-to-server requests, command-line tools, or any non-browser client, which entirely ignore CORS headers.