Test CORS access for a URL

With CORS tester, web developers and site testers can check a page or request before publishing. Test whether this URL accepts a request from the chosen Origin.

Test whether this URL accepts a request from the chosen Origin. The tool is free in your browser and shows the result without asking you to create an account.

How to use

Enter the address of the API or resource you want to test.
Add the origin that should be allowed to call it, after a space.
Start the test to check the CORS headers.
Read whether that origin is accepted and note the headers explaining the response.
Share the result with the team that manages the API or calling service.

Example

A front-end developer needs to know whether their site can call a remote interface. They enter the interface address, then the origin of their application, and run the check. The result helps decide whether to change the service CORS configuration or adapt the calling code before release.

Limits and formats

The test checks one specific origin, not every possible origin.
Headers can vary by HTTP method, request headers or credentials.
A browser may apply additional rules that this test does not show.
A favorable response does not guarantee that the application will allow the requested action.
Query only services you are allowed to test.

Where processing happens

The address to test and the chosen origin are sent to the YOORfree server. That server queries the target resource itself and returns the CORS information observed. No file is uploaded from your device. The result depends on the service response at that moment and on its header configuration.

Frequently asked questions

Why does the test fail when my call works locally?

CORS rules depend on origin, method and headers. A configuration that accepts one local origin may reject another origin or a different request. Compare the exact details of both cases and check the headers sent by each call.

Can I test several origins at once?

No, the field expects one address followed by one origin per test. To check several origins, run the verification for each one and note which are accepted.

Does the result show whether my API is secure?

No, it only shows whether a given origin appears allowed to call the tested address. API security also depends on authentication, authorization, input validation and other controls.