CORS Policy Checker (Access-Control-* Audit)

Audit CORS (Cross-Origin Resource Sharing) response headers for one or more URLs.

This actor sends a request with an Origin header and evaluates:

• Access-Control-Allow-Origin
• Access-Control-Allow-Credentials
• Access-Control-Allow-Methods (preflight)
• Access-Control-Allow-Headers (preflight)
• Access-Control-Expose-Headers
• Access-Control-Max-Age
• Vary: Origin

Optionally, it also performs a preflight OPTIONS request to validate that the server correctly allows the requested method/headers.

Input

• Start URLs: URLs to check
• Origin: Origin header value used for the main request
• Test second origin: If enabled, makes a second request with a different Origin to detect overly permissive/reflected policies
• Perform preflight: If enabled, performs an OPTIONS preflight request
• Proxy configuration: Optional Apify proxy

Output

Dataset (per URL)

Each dataset item contains:

• final URL + status
• CORS score (0-100)
• warnings/errors with codes
• parsed CORS-related headers
• optional preflight info

Key-value store

• SUMMARY: aggregate counts + average score
• REPORT: SUMMARY plus top issue codes

Notes / disclaimers

• CORS behavior depends on request method and headers; this actor checks a simple request plus optional preflight.
• A missing Access-Control-Allow-Origin is not necessarily a “security issue” — it often simply means the resource is not intended for browser cross-origin access.

Quick start

Store page: https://apify.com/scrappy_garden/cors-policy-checker

Paste this into Input and click Run:

{
  "startUrls": [
    {
      "url": "https://example.com/"
    }
  ],
  "proxyConfiguration": {
    "useApifyProxy": false
  }
}

Outputs (what you get)

• Dataset: Dataset items typically include fields like: startUrl, finalUrl, statusCode, redirected, corsScore, warningCount, errorCount, issues, checkedAt.
• Key-value store: REPORT, SUMMARY

Tips (trust + predictable results)

• Start with 1–3 URLs to validate behavior, then scale up.
• If a target blocks requests, enable Proxy and/or slow down concurrency in Input.
• Use the SUMMARY / REPORT keys (when present) for automation pipelines and monitoring.

Related actors

• broken-link-checker (https://apify.com/scrappy_garden/broken-link-checker)
• canonical-url-checker (https://apify.com/scrappy_garden/canonical-url-checker)
• meta-tag-analyzer (https://apify.com/scrappy_garden/meta-tag-analyzer)
• security-headers-checker (https://apify.com/scrappy_garden/security-headers-checker)

Search keywords

cors policy checker, cors policy checker - audit access-control-* headers, website audit, seo