CORS checker
Run a preflight and read the answer.
The check runs on our server. We do not store the domain.
What this checks
This tool sends a CORS preflight request — an OPTIONS request with an Origin header — to the domain's home page, and reads back whichever Access-Control-* response headers it sends. These headers are what let a page on one site read data from another.
What to look for
No Access-Control-Allow-Origin header means cross-origin reads are blocked by default, which is the safe starting point for anything that isn't meant to be a public API. Access-Control-Allow-Origin: * means any site can read the response — fine for public data, worth a second look for anything else.
The wildcard-plus-credentials case
Allow-Origin: * together with Allow-Credentials: true is a contradiction the CORS spec forbids: browsers refuse it and block the request, so nothing actually leaks. Seeing it still means the server's CORS policy was built incorrectly and should name real origins instead of a wildcard.