CORS Header Generator - Free, No Sign-Up

This CORS header generator builds the Access-Control-Allow-Origin, methods, headers, max-age and credentials rules your server needs so a browser app on another origin can call your API. Choose your origin, methods and server type, then copy ready-to-paste code for Apache, Nginx, Node.js (Express) or PHP. It is free and needs no sign-in.

What Are CORS Headers and What Do They Do?

CORS headers are HTTP response headers that tell a browser which other websites may read a response from your server. Cross-Origin Resource Sharing exists because browsers enforce the same-origin policy. A script on https://app.example.com cannot read data from https://api.example.com unless the API opts in. An origin is the combination of scheme, host and port, so even http versus https counts as a different origin.

Five response headers do most of the work:

• Access-Control-Allow-Origin names the origin that may read the response, either one origin or * for any.
• Access-Control-Allow-Methods lists the HTTP methods a cross-origin page may use.
• Access-Control-Allow-Headers lists the request headers the page may send, such as Content-Type or Authorization.
• Access-Control-Max-Age sets how many seconds a browser may reuse a preflight answer.
• Access-Control-Allow-Credentials set to true lets the page send cookies and similar credentials.

Before a request that uses PUT or DELETE, sends an Authorization header or posts JSON, the browser first sends an OPTIONS request called a preflight. Your server must answer it with the headers above, or the browser blocks the real request. The familiar console error "No Access-Control-Allow-Origin header is present" means the response did not include that header.

How to Use the CORS Header Generator

You fill in five fields, pick a server type and click one button to get the configuration. Follow these steps:

1. In Allowed Origins, keep * for a public API, or type one origin such as https://example.com.
2. Under Allowed Methods, tick the methods your API accepts. GET, POST and OPTIONS are ticked by default. PUT, DELETE, PATCH and HEAD are also available.
3. In Allowed Headers, list the request headers your front end sends, separated by commas. The default is Content-Type, Authorization.
4. Set Max Age (seconds). The default is 86400, which is 24 hours.
5. Tick Allow Credentials only if your page sends cookies or HTTP authentication. This option requires a specific origin, not the wildcard.
6. Choose your Server Type: Apache (.htaccess), Nginx, Node.js (Express) or PHP.
7. Click Generate CORS Headers, review the Generated CORS Configuration, and press Copy.

Worked Example: Allowing One Front End to Call Your API

Say your React app runs at https://app.example.com and calls an API that uses cookies for login. Enter that exact origin, keep GET, POST and OPTIONS ticked, add PUT so the app can update records, leave the default headers and Max Age, tick Allow Credentials and select Apache (.htaccess).

The tool returns a block that sets each header inside a check for the Apache headers module. You get an origin line for https://app.example.com, a methods line reading GET, POST, PUT, OPTIONS, a headers line reading Content-Type, Authorization, a max-age line of 86400 and a credentials line set to true. Paste it into the .htaccess file in your API's web root and reload the page that failed.

How to Read the Result and Choose Good Values

The output is a short server snippet whose values mirror what you entered, so check each line before you deploy it. The right values depend on who will call your API.

Allowed Origins

Use * only for data that is safe for anyone to read, such as a public JSON feed or a font file. For anything tied to a user account, enter the exact origin of your front end. The tool accepts one origin that includes the scheme and, if needed, the port, and it rejects paths and trailing slashes. https://example.com/ fails, while https://example.com works.

Allowed Methods and Headers

Allow only what your API really uses. A read-only API needs GET, HEAD and OPTIONS. If your front end sends a custom header such as X-Requested-With and it is missing from Allowed Headers, the preflight fails even when everything else is correct. Header names may contain letters, numbers and hyphens.

Max Age

A higher value means fewer preflight requests and faster repeat calls. Browsers apply their own ceilings, and Chromium-based browsers cap the cache at two hours, so a very large number will not hurt but will not always be honored. Use 0 while you are testing so each change takes effect immediately.

Credentials

When Allow Credentials is on, browsers refuse a wildcard origin. The generator stops you with a message asking for an explicit origin, which saves you from a configuration that would fail in the browser anyway.

When This Tool Is the Right Choice

It fits any situation where a browser blocks a cross-origin request and you control the server that sends the response. Typical cases include:

• A single-page app on one domain calling an API on a subdomain, such as app.example.com to api.example.com.
• A local development front end on http://localhost:3000 calling a staging API.
• A public API or static asset host that any site should be able to read.
• A team that wants a clean, consistent snippet to paste into a pull request instead of writing headers from memory.

If you are on Apache and also need redirects, the .htaccess redirect generator produces rules you can place in the same file. Many more utilities like this sit in the web developer tools hub.

Best Practices, Common Mistakes and Troubleshooting

Most CORS problems come from small mismatches between what the browser sends and what the server allows. Work through these checks in order.

• The error persists after you paste the code. Clear the cache or test in a private window, since browsers store preflight results. Then open the Network tab and confirm the response actually includes the header.
• The origin does not match exactly. The port, the scheme and www all count. https://www.example.com and https://example.com are different origins.
• The preflight fails with a 404 or 405. Your application must answer OPTIONS requests with a success status. The Node.js and PHP output already ends OPTIONS requests early, but with Apache or Nginx you must confirm your backend route accepts OPTIONS.
• Duplicate headers. If both your web server and your application add Access-Control-Allow-Origin, browsers may reject the response. Set CORS in one layer only.
• A wildcard with credentials. This is never valid. Replace * with your real origin.
• Everything is allowed just to make the error go away. Opening every method and origin is quick, but it widens access more than most APIs need. Start narrow and add only what the browser complains about.

After you paste the snippet into a config file, a code diff tool helps you confirm exactly what changed before you deploy. If you edit the output by hand, the code beautifier can tidy the formatting.

Limitations to Keep in Mind

The generator covers the standard header set for four server types, and it has a few deliberate boundaries. It accepts one origin or the wildcard, so it cannot produce a list of several allowed origins. Supporting several origins normally means your server code compares the incoming Origin header with an allowed list and echoes back the match, usually with a Vary: Origin header. You would add that logic yourself.

The Nginx output uses add_header lines, which by default apply only to successful and redirect responses, so error pages may lack the headers. It also does not add a dedicated OPTIONS response, so you may need to add one in your location block. If you use Django, the django-cors-headers package manages these settings in your project configuration instead, and this tool does not generate that format. It also cannot check your live site, so test the finished setup in a browser.

Set your origin, methods and server type above, click Generate CORS Headers and copy the result into your server. You will get a clean snippet in seconds, and a clear next step if the browser still complains.