Free tool · no signup
CORS checker
We contact your site pretending to be an unknown website, with no logins and nothing changed, and check whether it would let that website read your responses or use your visitors' logins.
Only public pages are read. Results are not stored.
Prompt: tighten CORS
Review CORS on every server route and server function. Only allow my own site's address in Access-Control-Allow-Origin (never echo back the request's Origin, never allow "null"), and never combine Access-Control-Allow-Credentials: true with a wildcard or echoed origin. Public read-only endpoints may use *, but without credentials. Limit Access-Control-Allow-Methods and Access-Control-Allow-Headers to what the app actually uses.
Frequently asked questions
- What is CORS?
- Cross-Origin Resource Sharing tells browsers which other websites may read your site's responses. Set too loosely, a malicious page can read private data from your app.
- Is Access-Control-Allow-Origin: * always bad?
- No. It is fine for public, read-only data. It becomes risky when it is combined with logins or used on private endpoints.
- Why isn't Supabase's open CORS flagged?
- Supabase's API accepts any website by design. Your data is protected by Row Level Security policies on each table, so check those instead.
- What does this check send to my site?
- Only harmless GET and OPTIONS requests from a made-up website address, with no cookies or logins. Nothing is changed and no results are stored.
- Does SaaS Sentinel check this automatically?
- Yes. The daily Public exposure check for each app you monitor includes the same CORS test.
More free tools
Lovable security checker
Leaked secret keys, exposed .env files, source maps and security headers.
Link preview checker
How your link looks when shared on Google, X, LinkedIn, Facebook and Slack.
DNSSEC checker
Whether your domain's DNS is signed, so visitors can't be sent to a forged server.
404 page checker
Whether missing pages return a real, branded 404 that helps visitors back.