CORS checker

What CORS controls

Browsers block a page's JavaScript from reading a cross-origin response by default, unless the server explicitly opts in with CORS headers. It is a header-based permission system checked by the browser after the response arrives (for a "simple" request) or before it is even sent (for a "preflighted" one) - not something the server can fail to configure and have the browser silently work around.

What this actually sends

Two real requests: a plain GET carrying an Origin header, and an OPTIONS preflight carrying Access-Control-Request-Method: GET and Access-Control-Request-Headers: content-type - the same shape a browser sends before a fetch() that includes a custom header. The test origin is a fixed, neutral one (not the site's own), so a "yes" here reflects the server's general policy, not special-casing for a specific known origin.

Why one test cannot answer every case

CORS behavior legitimately varies by the exact Origin sent, the HTTP method, and which headers are requested - a server can allow GET from anywhere but restrict PUT to one specific origin, or allow one origin exactly and refuse all others rather than answering with a wildcard. This shows one representative, realistic case clearly, not every possible combination.

Related tools

See security headers checker and CSP checker for the other header-based protections on the same page.