Security
CORS Tester
Enter a public API URL and the origin of the page that calls it. One response and one OPTIONS preflight report Access-Control-Allow-Origin, credentials, methods, headers, exposed headers, and Vary. Private API addresses are refused. Other origins are not tried, and the result is not stored.
Score
86%
Type
Lookup
Core features
Allow-Origin
See whether the response allows the frontend origin, a wildcard, or a different site.
Preflight
Check Allow-Methods and Allow-Headers for POST, PUT, PATCH, and DELETE.
Credentials and cache
Flag a wildcard paired with credentials, and a specific origin that forgets Vary.
Specifications
| Requests | Response plus OPTIONS |
|---|---|
| Methods | GET, HEAD, POST, PUT, PATCH, DELETE |
| Target | Public http or https |
| Privacy | Not stored |