Security Tools

CORS Header Checker

Check which other websites a site or API allows to read its responses (CORS).

Not sure what to enter? Try an example: api.github.com

Free & instant No signup How to use FAQ

Enter a URL to see its Access-Control-Allow-Origin and related CORS headers.

What is CORS?

CORS (Cross-Origin Resource Sharing) headers such as Access-Control-Allow-Origin tell browsers which other websites may read responses from your server with JavaScript. A missing header blocks legitimate cross-site requests; an overly broad one - * combined with credentials - can expose private data.

How to check CORS headers

Enter the domain or API URL in the box above.
Click Check CORS.
Review Access-Control-Allow-Origin and the related allow-methods/headers/credentials values.
Allow only the specific origins that need access, especially on endpoints that use cookies or tokens.

Related checks

To see every response header, use the HTTP Headers Checker.
For all security headers at once, use the Security Headers Checker.

Access-Control-Allow-Origin: * together with credentials is a common mistake - allow only the origins that really need your API. JustChecker monitors your headers and flags unexpected changes.

Frequently Asked Questions

The server receiving the request - not your page - must send Access-Control-Allow-Origin for your site's origin. Add it in the API's server or framework settings.

For public data and files, yes. For anything that uses logins or cookies, list your exact origins instead - browsers also refuse * together with credentials.

No - it only controls what browsers let other sites read. Requests from servers, scripts or tools like curl ignore CORS, so you still need authentication.

Share this tool:

Need a website for your business? Only $599