Does my browser fetch the URL directly for this check?

No — checking a CORS header on an arbitrary domain from your browser hits the very CORS restriction the header controls, so Tool4U's own server performs the fetch and reports the Access-Control-* headers back to you. The URL isn't logged or stored.

Why would my fetch() call fail even though this shows CORS headers?

CORS is enforced by the browser per-request, and can depend on the exact request method/headers used (a "preflight" OPTIONS request) — this check shows a plain GET’s headers, which is a strong signal but not a guarantee for every request shape.

What does a wildcard Access-Control-Allow-Origin mean?

* means the response allows cross-origin requests from any website — common for public, read-only APIs; sensitive or authenticated endpoints usually list specific origins instead.

CORS Header Checker

Inspect a URL’s Access-Control-* response headers to see what cross-origin access it allows.

URL

The URL is fetched from our server (an arbitrary cross-origin fetch isn't possible directly from your browser) — the target site sees this server's request, not your IP, and nothing about the check is stored.

Related tools

How it works

1
Enter a URL (often an API endpoint)
Including the protocol.
2
CORS headers read
Access-Control-Allow-Origin/Methods/Headers/Credentials.
3
See what it allows
Whether cross-origin requests are permitted, and from where.

FAQ

Does my browser fetch the URL directly for this check?: No — checking a CORS header on an arbitrary domain from your browser hits the very CORS restriction the header controls, so Tool4U's own server performs the fetch and reports the Access-Control-* headers back to you. The URL isn't logged or stored.
Why would my fetch() call fail even though this shows CORS headers?: CORS is enforced by the browser per-request, and can depend on the exact request method/headers used (a "preflight" OPTIONS request) — this check shows a plain GET’s headers, which is a strong signal but not a guarantee for every request shape.
What does a wildcard Access-Control-Allow-Origin mean?: * means the response allows cross-origin requests from any website — common for public, read-only APIs; sensitive or authenticated endpoints usually list specific origins instead.