CORS Checker
Check pasted headers for CORS settings and risks.
Runs in your browser. Nothing is uploaded — your input is processed on this device and discarded when you close the tab.
CORS Checker
How to use this tool
- Enter your values in the fields above.
- Press Generate to see the result.
- Use Load sample to try the worked example, Copy result to copy it, or Clear to start again.
Worked example
Pasting Allow-Origin * with Allow-Credentials true reports both values and flags the wildcard-plus-credentials risk.
What this tool does not do / Limits
Only pasted headers are read. This does not test a live site, and header presence alone does not prove a browser will allow a given request.
Frequently asked questions
Why is wildcard origin plus credentials risky?
It can let other origins make credentialed requests, which weakens the protection CORS is meant to provide.
Does this test my live site?
No. Paste the headers yourself; this tool never contacts a site.
Related tools
JSON Studio
Format, validate, minify, query and compare JSON in your browser, with precise line-and-column errors.
LiveRegex Tester
Test patterns against sample text with match highlighting, capture groups and a safe one-second timeout.
LiveSecurity Header and DNS Checker
Check HSTS, CSP and other security headers, TLS details, and DNS/email authentication records (SPF, DKIM, DMARC).
Live