CORS Misconfiguration Checker
Overly open CORS can let other sites read data from your users' sessions. Test the common mistakes safely.
GO DEEPERWhat do you want to uncover next?
What this tool checks
- Whether arbitrary origins are reflected
- The null origin
- Wildcard origin combined with credentials
- Origin matching bypasses (prefix and suffix)
- Preflight methods and headers
- Vary: Origin
How to read the result
The tool only sends harmless GET and OPTIONS requests with test origins. "No CORS headers" is the secure default for pages that should not be read by other sites.
Terms explained
Frequently asked questions
Is a wildcard origin always bad?
Not for fully public, unauthenticated data. It is dangerous together with credentials or private data.
What is the safest approach?
Allow only an explicit list of trusted origins and send Vary: Origin.
Does this test my login endpoints?
It tests the URL you enter. Check your authenticated API URLs too.