CORS Tester

Use this little website to test if a URL is setup correctly to work with CORS.




If your CORS setup is not using a wildcard then this should be a domain that matches your AllowedOrigins


Shareable link:

Results

This URL will not work correctly with CORS.

What's wrong?

It does not have the access-control-allow-origin header set to *. Without this header, requests from other domains cannot be made to it via a users browser.

How to fix it?

If you have access to the server for the URL, you'll need to modify it to add the access-control-allow-origin header. If you do not have access, you'll need to upload the file somewhere else.

Headers

These are the response headers received when making the request.

cache-control: no-cache, must-revalidate, max-age=0, no-store, private
cf-cache-status: DYNAMIC
cf-ray: 9e7b2664cc9cfad4-CMH
content-type: text/html; charset=UTF-8
date: Sun, 05 Apr 2026 20:02:24 GMT
link: ; rel="https://api.w.org/", ; rel="alternate"; title="JSON"; type="application/json", ; rel=shortlink
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=BuPnOl%2FANDf4hNDz2P21fOxlmfy1y1MPWG7QRR%2FsUll37hwyn%2FL5jPoKxQBWIK43e%2F1kP1UYOkXFR1QDuxHmzaAIqtF9USwOdVdrUSEobjIpN7S5P%2F1qcH3i42gtLK5LizXyt64j1WfO5g%3D%3D"}]}
server: cloudflare
strict-transport-security: max-age=15768000; includeSubDomains
transfer-encoding: chunked
vary: Accept-Encoding
x-dns-prefetch-control: on
x-litespeed-cache-control: no-cache
x-powered-by: PHP/8.3.30, PleskLin

CORS tester was built by @mscccc. The code is available on GitHub. Sponsored by HTML/CSS to Image.