What is a CORS Checker?
“Blocked by CORS policy” is the error every frontend developer meets. The truth is always in the response headers: which origin the server allows, and whether it allows yours.
This checker requests your URL with a configurable Origin header and reports the Access-Control-* answer with a plain verdict.
Frequently asked questions
Is CORS a server or browser thing?
The server declares policy in headers; the browser enforces it. Fixes always happen server-side, no frontend code can bypass it (nor should it).
Why does the request work in curl but not the browser?
CORS only applies to browsers. curl ignores it entirely: which is why testing with the right Origin header (as this tool does) matters.
What is a preflight?
For non-simple requests (custom headers, PUT/DELETE, JSON content type) the browser first sends OPTIONS. Your server must answer it too.
Is Access-Control-Allow-Origin: * safe?
For public, credential-less APIs, yes. Never combine * with credentials: browsers reject it, and reflecting arbitrary origins with credentials is a vulnerability.