CORS Tester
Sends the preflight a browser would send from a chosen origin plus a GET with that Origin, and explains by the Fetch standard’s rules exactly which header blocked it.
A CORS failure in the console names the header that was missing and almost never the reason, and the request the browser actually sent is not the one in your code. This sends the preflight a browser would send from an origin you choose, then a GET carrying that Origin, and reads the result against the Fetch standard’s rules.
Our server makes this request for you. Only the URL, origin, method and header names you enter is sent to it — none of your cookies or login state goes along. The server will only connect to public addresses and refuses private and internal ones.
How to use it
Enter the URL and the origin
The origin is the site the request would come *from* — the page making the call, not the API. Getting these the wrong way round is the most common reason a test disagrees with the browser.
Add the method and headers you really use
A preflight only happens for non-simple requests. `Content-Type: application/json` or an `Authorization` header is what triggers it, so leaving them out tests a request you never make.
Read which rule failed
The result names the specific check — origin not allowed, method not listed, header not listed, credentials with a wildcard origin — rather than reporting a generic failure.
Common questions
It passes here but the browser still blocks it.
Check that the method, headers and credentials mode match exactly what your code sends, and that the server does not vary its response by cookie or by user agent. This runs from a server, so a response that depends on a session you have will differ.
Why does `Access-Control-Allow-Origin: *` not work with cookies?
The standard forbids it. With `credentials: 'include'`, the origin must be echoed literally and `Access-Control-Allow-Credentials: true` must be present. A wildcard with credentials is rejected by design, not by a bug.
Does this run in my browser?
No — it runs from a server, because a browser cannot make the request that CORS blocks. That means it sees the public response, without your cookies or your network position.
Can I test an internal address?
No. The request originates from a server that cannot reach your network, and addresses that only resolve inside it will fail regardless of their CORS configuration.
Feed it from
CSP Builder
Builds a Content-Security-Policy from a guided form or from a report, and explains each directive.
Security Header Scan
Grades a site’s HSTS, CSP, frame, referrer and permissions headers and shows what to add.
Password Strength Meter
Estimates how long a password would take to crack, naming the patterns that weaken it.
TOTP Code Generator
Turns a TOTP secret into the current six-digit code with a countdown, for testing 2FA setups.
Next
These accept what this tool produces, so the result can go straight in.
CSP Builder
Builds a Content-Security-Policy from a guided form or from a report, and explains each directive.
HTTP Request Builder
Composes and sends a GET/POST/PUT/PATCH/DELETE/HEAD request with custom headers and a body, and shows the status, headers, body and timing — without ever forwarding cookies or Authorization.
HTTP Header Inspector
Fetches a URL and shows the full response headers, redirect chain, timings and compression used.
Security Header Scan
Grades a site’s HSTS, CSP, frame, referrer and permissions headers and shows what to add.
CSV Cleaner
Trims cells, normalises headers, fixes number and date formats and reports rows with the wrong column count.
CSV Join
Joins two tables on a key column with inner, left, right or outer semantics and shows unmatched rows.