Free CORS Checker
Test CORS configuration for any URL
Enter any URL to test its Cross-Origin Resource Sharing (CORS) configuration. This tool sends a request with a spoofed origin header and inspects the response to determine whether the server is vulnerable to cross-origin attacks from malicious websites.
Trusted by teams at
How it works
How CORS Checker works
Enter a URL
Paste any URL — typically an API endpoint or page you want to test. We add HTTPS if needed.
Send cross-origin requests
We send requests with a spoofed Origin header (https://evil.com) and check how the server responds — specifically whether it reflects the origin or allows credentials from untrusted domains.
Analyze CORS headers
Get a detailed breakdown of all CORS response headers, their security implications, and whether the configuration is safe or exploitable.
Features
What CORS Checker checks
Origin reflection detection
Tests whether the server blindly reflects any Origin header in Access-Control-Allow-Origin — a critical misconfiguration that lets any website make authenticated cross-origin requests.
Credentials exposure check
Detects if Access-Control-Allow-Credentials is set to true alongside a permissive Allow-Origin, which would allow attackers to steal authenticated user data from their browser.
Wildcard origin analysis
Identifies whether the server uses Access-Control-Allow-Origin: * and explains when this is safe (public APIs) versus dangerous (authenticated endpoints).
Preflight and method analysis
Checks Access-Control-Allow-Methods and Access-Control-Allow-Headers to identify overly permissive configurations that expose dangerous HTTP methods.
Use cases
Who should use the free CORS Checker
API Developers
Verify your API's CORS configuration is correctly scoped to trusted origins before deploying to production. Catch wildcard origins and reflected origins early.
Security Engineers
Audit CORS policies across your organization's APIs and web services. Identify endpoints that are vulnerable to cross-origin data theft from malicious websites.
Penetration Testers
Test for CORS misconfigurations during web application assessments. Origin reflection with credentials is a high-severity finding that enables cross-origin data exfiltration.
More tools
All free security tools
Scanners
(10)Checkers
(6)Decoders & Generators
(3)FAQ
Frequently asked questions
Everything you need to know about the free CORS Checker.
Go beyond CORS Checker
This free CORS Checker checks a handful of things. Maced's AI pentest checks thousands.
Get a full autonomous penetration test — including OWASP Top 10, authentication flaws, business logic errors, API security, and more — with a compliance-ready report in hours.
Proof of exploit on every finding · SOC 2 & ISO 27001 compatible