Security Tools
CORS Header Checker
Check a website's CORS (Cross-Origin Resource Sharing) headers.
Enter a domain to check its CORS (Cross-Origin Resource Sharing) response headers.
JustChecker monitors your security headers continuously and alerts you if any regress.
Frequently Asked Questions
Browsers block a page on one domain from making requests to a different domain's API by default (the same-origin policy) - CORS headers are how a server explicitly opts in to allowing specific other domains to make cross-origin requests to it.
It allows any domain whatsoever to make cross-origin requests to your API - fine for a genuinely public, unauthenticated API, but a real risk if the same endpoint also handles authenticated/sensitive requests via cookies or credentials.
The endpoint working when called directly (e.g. from a server, or Postman) doesn't mean it's configured to allow BROWSER-based cross-origin requests - CORS is a browser-enforced restriction, not a server-side existence check.
For certain request types (like ones using custom headers or non-simple methods), browsers first send an OPTIONS request asking permission before the actual request - your server needs to correctly respond to this preflight, not just the final request.
Not inherently - it depends entirely on what the endpoint does; permissive CORS on a public, read-only API is normal and intentional, while the same permissiveness on a credentialed, sensitive endpoint would be a genuine concern.
No - CORS only affects browser-based, cross-origin JavaScript requests; it provides no protection against direct server-to-server requests, command-line tools, or any non-browser client, which entirely ignore CORS headers.