CORS Header Analyzer

Paste response headers and get a plain-English breakdown of what the CORS policy allows and blocks.

Response headers

Simulate a request from

using

Verdict

Header-by-header breakdown

Tip: The browser — not the server — enforces CORS. These headers only matter for cross-origin requests; same-origin requests are never blocked regardless of what's set here.