• Network & DNS
Test the Cross-Origin Resource Sharing policy of any API or endpoint. Detect misconfigured CORS that could expose data.
Domain or URL only — e.g. example.com or https://example.com/page → checks example.com
• About this tool
Check any URL's CORS policy by sending a preflight OPTIONS request. Detect Access-Control-Allow-Origin misconfiguration that may expose APIs to cross-origin attacks.
• FAQ
Cross-Origin Resource Sharing (CORS) is a browser security mechanism that restricts which origins can make requests to an API or resource.
A misconfiguration occurs when Access-Control-Allow-Origin is set to * (all origins) or reflects the requester's Origin header without validation, allowing any website to read API responses.
For non-simple requests (e.g. DELETE or requests with custom headers), browsers send an OPTIONS preflight to check if the server allows the actual request.
Configure your server to return the correct Access-Control-Allow-Origin header for trusted origins only. Never use * on authenticated endpoints.
• Related
HTTP Security Headers Checker
Audit the HTTP security headers of any website. Score CSP, HSTS, X-Frame-Options, and more.
SSL Certificate Checker
Inspect the SSL/TLS certificate for any domain. Check validity, expiry, issuer, and certificate chain.
CDN & WAF Detector
Detect the CDN or Web Application Firewall protecting any website. Identify Cloudflare, Akamai, AWS, and more.
• automated security
PandaONE runs autonomous agents against your app, validates findings with proof, and opens fixes as pull requests.
Request Access