CORS policy analyzer

Paste your Access-Control-* response headers. We grade against the things that actually go wrong — wildcard with credentials (browser refuses), Allow-Origin: null (exploitable by sandboxed iframes), reflected origin without an allowlist.

CORS response headers

Access-Control-Allow-Origin

Access-Control-Allow-Methods

Access-Control-Allow-Headers

Access-Control-Allow-Credentials: trueThis endpoint handles authenticated / sensitive data

Quick reference: CORS is a browser-enforced policy — it does not protect your server. Any HTTP client (curl, Postman, a script) ignores it. CORS only controls whether JavaScript running on another origin can read your responses. If your data is sensitive, you still need authentication on the server.

Keep hardening your site

This is one check of many. Run the rest — every tool is free, no account.

Scan your site's security headers →See the full platform →

Security headers scan

Grade your live response headers

TLS certificate scan

Grade chain, expiry, and key strength

Security headers builder

Emit a ready-to-paste header block

CSP analyzer

Grade your Content-Security-Policy

Cookie security audit

Check Secure, HttpOnly, SameSite

Mixed-content scanner

Find http:// assets on https pages

Open-redirect detector

Probe redirect params for abuse

HSTS preload checker

Grade against Chrome's preload list