• Network & DNS

CORS Policy Checker

Test the Cross-Origin Resource Sharing policy of any API or endpoint. Detect misconfigured CORS that could expose data.

Domain or URL only — e.g. example.com or https://example.com/page → checks example.com

• About this tool

What is CORS Policy Checker?

Check any URL's CORS policy by sending a preflight OPTIONS request. Detect Access-Control-Allow-Origin misconfiguration that may expose APIs to cross-origin attacks.

cors checkercors policy testeraccess-control-allow-origincors misconfigurationcors error checkercors debugger

• FAQ

Frequently asked questions

What is CORS?

Cross-Origin Resource Sharing (CORS) is a browser security mechanism that restricts which origins can make requests to an API or resource.

What is a CORS misconfiguration?

A misconfiguration occurs when Access-Control-Allow-Origin is set to * (all origins) or reflects the requester's Origin header without validation, allowing any website to read API responses.

What is a preflight request?

For non-simple requests (e.g. DELETE or requests with custom headers), browsers send an OPTIONS preflight to check if the server allows the actual request.

How do I fix a CORS error?

Configure your server to return the correct Access-Control-Allow-Origin header for trusted origins only. Never use * on authenticated endpoints.

• Related

Security

HTTP Security Headers Checker

Audit the HTTP security headers of any website. Score CSP, HSTS, X-Frame-Options, and more.

Security

SSL Certificate Checker

Inspect the SSL/TLS certificate for any domain. Check validity, expiry, issuer, and certificate chain.

Network & DNS

CDN & WAF Detector

Detect the CDN or Web Application Firewall protecting any website. Identify Cloudflare, Akamai, AWS, and more.

• automated security

Need continuous coverage?

PandaONE runs autonomous agents against your app, validates findings with proof, and opens fixes as pull requests.

Get started