CORS Probe: Access-Control Headers Explained
Read a URL's Access-Control-* answers as a browser enforces them, preflight included.
Request method
Custom headers force a preflight. The probe checks the OPTIONS answer.
Browser egress
The probe rides this project's proxy server (GET/HEAD/OPTIONS, public hosts, capped, rate-limited): the browser cannot enumerate hidden cross-origin response headers to test them. This page leaves your browser only when you press the button; never on load, never in the background. Nothing is sent anywhere else, and no analytics loads on this page.
Reads the Access-Control-* answers exactly as a browser enforces them: allow-origin (wildcard vs specific), credentials, exposed headers, and, when the request needs one, the OPTIONS preflight's methods, headers, and max-age.
Paste, drop, or type to begin. Everything stays on this device.