What this CORS checker tests
Cross-Origin Resource Sharing, or CORS, is the browser rule that decides whether code running on one website is allowed to read responses from another. A site controls this with the Access-Control-Allow-Origin header and a few companions. Get it right and your APIs work for the origins that need them. Get it wrong and you can hand attackers a way to read private, authenticated data from a victim's logged in session.
This checker fetches the live response from the URL you enter and reports three things that decide whether the policy is safe. It shows the allowed origin, whether the server reflects whatever origin the caller sends, and whether it also allows credentials such as cookies. The dangerous combination is a server that reflects the origin and allows credentials, because that lets any website make authenticated requests and read the answers on behalf of your users.
How to fix a weak CORS policy
The safe pattern is an explicit allowlist. Decide exactly which origins need cross-origin access, return only those values in Access-Control-Allow-Origin, and enable credentials only for origins you trust. Avoid reflecting arbitrary origins and avoid pairing a wildcard with credentials. When you are ready to write the configuration, the free CORS header generator produces a safe set of headers you can copy straight into Nginx, Apache, or your app.