🔒 Runs in your browser — nothing is uploaded✓ Free, no signup
CORS & Security Headers Generator
Choose allowed origins, methods and headers, add recommended security headers, and get ready-to-paste config for your server or hosting platform.
CORS
Security headers
Config
add_header Access-Control-Allow-Origin "https://app.example.com" always;
add_header Vary "Origin" always;
add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS" always;
add_header Access-Control-Allow-Headers "Content-Type, Authorization" always;
add_header Access-Control-Max-Age "86400" always;
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
if ($request_method = OPTIONS) {
return 204;
}When should you use the CORS Header Generator?
- Fixing 'blocked by CORS policy' errors for a frontend calling your API
- Adding security headers before a launch or security review
- Translating header settings between Nginx, Apache, Express and Next.js
How to use the CORS Header Generator
- 1
Set allowed origins
List the sites that may call your API, or * for any public site.
- 2
Choose methods and headers
Include every method and custom header your frontend sends, such as Authorization.
- 3
Add security headers
HSTS, nosniff, X-Frame-Options and Referrer-Policy are safe defaults for most sites.
- 4
Pick your server
Copy the config for Nginx, Apache, Express, Next.js, vercel.json or Netlify.
Examples
One origin, raw headers
Origins
https://app.example.com
Headers (excerpt)
Access-Control-Allow-Origin: https://app.example.com Vary: Origin Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS Access-Control-Allow-Headers: Content-Type, Authorization
Common errors and how to fix them
Credentials don't work with *- Browsers reject Allow-Credentials: true with Allow-Origin: *. List the exact origins instead.
Preflight (OPTIONS) requests fail- The server must answer OPTIONS with a 2xx status and the CORS headers. The Nginx and Apache configs include this.
More from Web & Network
Free tools that run in your browser — no signup, nothing uploaded.
URL Parser & Query String Parser
Break a URL into protocol, host, path, query parameters and hash.
IP Address Converter
Convert IPv4 between dotted, decimal, hex and binary, and expand IPv6.
HTTP Status Codes List
Every HTTP status code explained in plain English — searchable.
User Agent Parser & Checker
See your user agent and parse any UA string into browser, OS and device.
IP Subnet / CIDR Calculator
Calculate network, broadcast, host range and mask for any IPv4 CIDR.
Meta Tag & Open Graph Generator
Generate SEO meta tags, Open Graph and X card tags with live previews.
Cookie & Set-Cookie Parser
Parse Cookie and Set-Cookie headers into a readable table with security checks.
What Is My Screen Resolution?
See your screen resolution, viewport size and device pixel ratio instantly.
JavaScript Keycode Finder
Press any key to see its event.key, event.code and keyCode.
CORS Header Generator FAQ
Cross-Origin Resource Sharing: headers a server sends to tell browsers which other sites may read its responses. Without them, browsers block cross-site API calls.
Access-Control-Allow-Origin can only hold one origin, so the server must echo the request's Origin when it's in your list. The Nginx, Apache and Express configs do this for you.
An automatic OPTIONS request browsers send before non-simple requests (like JSON POSTs or requests with Authorization) to check that CORS allows them.
Strict-Transport-Security, X-Content-Type-Options: nosniff, a framing policy (X-Frame-Options or CSP frame-ancestors) and a Referrer-Policy. A Content-Security-Policy adds strong protection but needs testing.
No. CORS is enforced by browsers only. Server-to-server calls ignore it, so use authentication for real protection.
No. Everything runs in your browser, so your settings never leaves your device.