IconVault logoIconVault
Sign in

CORS Tester - Free Online CORS Testing Tool | IconVault

Test a URL's CORS policy from your browser: status, timing, response headers, plus a preflight explainer and Express, Nginx and Apache config snippets. Free.

All tools

CORS Tester

Test a URL's CORS policy from your browser

5 of 5 free uses left

How to read this tool: CORS is enforced by your browser, not by the server. This page can only observe what the browser allowed or blocked. Browsers deliberately hide the reason for a failed request, so a CORS block and a network error look identical here. If a URL loads in a new tab but fails this test, it is being blocked by CORS.

Method

5 of 5 free tests left.

When does the browser preflight?

Simple GET/POST requests go straight out. Anything else (PUT, DELETE, custom headers, JSON content types) first sends an OPTIONS preflight. The server must answer it with Access-Control-Allow-Origin and the matching methods and headers, or the real request never leaves the browser.

Result

No test run yet

Enter a URL and run the test to see what your browser allows.

Server-side fix snippets

// npm install cors
import cors from "cors";

app.use(cors({
  origin: "https://your-site.com",
  methods: ["GET", "POST", "PUT", "DELETE"],
  allowedHeaders: ["Content-Type", "Authorization"],
  credentials: true,
}));

Replace the origin with your frontend's real origin. Never use * together with credentials.

About this tool

IconVault's CORS Tester fires a real fetch from your browser to any URL you enter, using GET or POST, and reports what the browser allows: the HTTP status, round-trip time and the response headers the server exposes. If the request is blocked by the browser's same-origin policy, the tool says so plainly instead of failing silently.

A preflight explainer walks through when browsers send an OPTIONS preflight and why, and ready-to-copy server config snippets for Express, Nginx and Apache show how to allow your origin properly. It is honest about the limits: CORS is browser-enforced, so this tool can only observe what a browser permits. Free and runs fully in your browser.

Frequently asked questions

Popular searches

cors testertest cors onlinecors policy checkercors check urlcheck cors headerscors error checkercors blocked testpreflight request testoptions preflight checkaccess control allow origin checktest cross origin requestfetch cors testbrowser cors testcors api testercors debug toolcors configuration testerexpress cors snippetnginx cors configapache cors headerscors setup expressenable cors nginxcors headers generatorfix cors errorcors error fixno access control allow origincors policy blockedcors header missingallow cross origin requestscors credentials testcors allowed methods checkcors allowed headerspreflight response checktest api cors policycors checker freeonline cors checkerfree cors test toolwebsite cors testdomain cors checkcors test post requestcors get request testcors request blocked browsercors is browser enforcedunderstand cors preflightcors tutorial testcors snippet generatorcors express middlewarecors nginx add headercors apache configallow origin wildcard testcors test online freecheck cors policy headerscors response headers listdebug preflight failure

More tools

Code Playground

Write HTML, CSS & JS with live preview.

JSON Formatter

Beautify, validate & minify JSON.

Base64 Encoder

Encode & decode text and files.

JWT Decoder

Inspect tokens without sending them anywhere.

Coming soon

CLI

Coming soon

Figma plugin

Coming soon

VS Code extension

Coming soon

Chrome extension

Coming soon

AI icon generator

Coming soon

Team workspaces

Coming soon

View all 10+ tools →