About CORS Checker
Enter a URL, optional request headers (key/value rows), and the origin you care about. GitCircle runs GET and OPTIONS probes and reads any Access-Control-* headers the browser exposes.
Browsers block JavaScript from setting Origin (and a few other headers) on fetch. If you add Origin in the header list, it is skipped in the live probe—use Evaluate origin plus the generated curl commands, then paste response headers below the header rows.
How to use it
- Enter the API URL (single line).
- Add request headers with Add header (for example
Authorization). - Set Evaluate origin or leave blank to use this page’s origin.
- Optionally paste response headers from curl after a blocked live probe.
- Click Check CORS, or press ⌘/Ctrl + Enter.
Common errors
- Forbidden in browser fetch — Includes
Origin,Host,Cookie. Use curl for those. - Failed to fetch — CORS blocked for this tab, TLS, or mixed content.
*with credentials — Invalid in browsers.
For header scoring without CORS, use the HTTP Security Headers Checker.