CORS Header Generator
Generate correct CORS headers for Apache, Nginx, PHP or Express — with credential-mode validation built in.
This tool runs 100% in your browser. Your data is never uploaded, stored, or logged.
Generated configuration
About this tool
CORS errors block more launches than almost anything else — and most "fixes" pasted from forums are subtly wrong. This generator builds a correct CORS configuration for your stack: allowed origin, methods, headers, max-age and credentials, plus the preflight OPTIONS handling most snippets forget.
It also refuses invalid combinations, like wildcard origin together with credentials, explaining why browsers reject them.
How to use it
- Enter your allowed origin (use a real origin, not *, if you send cookies).
- List the methods and request headers your API accepts.
- Pick your target: Apache .htaccess, Nginx, PHP or Node/Express.
- Copy the config — preflight handling is included.
Useful ways to apply it
- Fixing "blocked by CORS policy" errors on a new API.
- Allowing a JS frontend on one domain to call an API on another.
- Configuring shared hosting (.htaccess) without server access.
- Standardizing CORS across environments with one source of truth.
Frequently asked questions
Why can't I use * with credentials?
The CORS spec forbids Access-Control-Allow-Origin: * when Access-Control-Allow-Credentials is true — browsers reject the response. Use your exact origin instead; this tool enforces that.
What is Access-Control-Max-Age?
How long (in seconds) browsers may cache the preflight response, reducing OPTIONS traffic. 86400 (24h) is a common ceiling — browsers cap it anyway.
Do I still need server-side auth?
Absolutely. CORS controls which web origins can read responses in a browser — it is not authentication and does nothing against direct requests.
Privacy
This tool runs 100% in your browser. Your data is never uploaded, stored, or logged.