Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
To fix a browser CORS error, add the correct Access-Control-Allow-Origin response header at the server that serves the requested resource. In Apache, that normally means a carefully scoped mod_headers rule in the applicable .htaccess file. The change works only when the host allows FileInfo overrides and has mod_headers loaded. Use an exact origin for private or credentialed requests; reserve * for genuinely public, non-credentialed resources.
What a CORS change in .htaccess actually fixes
Cross-Origin Resource Sharing (CORS) is enforced by browsers. A page loaded from one origin may request an API, JavaScript file, font, image, or other resource from another origin, but the browser lets frontend code read the response only when the response contains an appropriate CORS header.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
An origin is the combination of scheme, host, and port. For example, https://app.example.com, https://app.example.com:8443, and http://app.example.com are different origins. A path is not part of the origin, so an allowlist entry must not include /dashboard or a trailing slash.
An Apache rule changes the HTTP response emitted by the server. It does not grant a user permission, bypass WordPress authentication, or make an unrelated remote API send CORS headers. If the browser is calling a server you do not control, a local WordPress .htaccess file cannot repair that remote response.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
Use the smallest scope that solves the problem. A rule in the document-root file can affect every response under that directory, while a rule in the directory serving a particular API or asset set can limit exposure.
Choose the CORS policy before editing
The right header depends on whether the resource is public and whether the browser sends credentials. Do not start by copying a wildcard rule; decide what the browser should be allowed to read.
| Use case | Access-Control-Allow-Origin |
Credentials | Other requirements |
|---|---|---|---|
| Public, anonymous asset or API | * |
No cookies or credentialed fetch | Limit the rule to the public resource where practical. |
| One private frontend | Exact origin such as https://app.example.com |
Use an explicit origin when the request is private | Add Vary: Origin when responses vary by requesting origin. |
| WordPress session or other credentialed browser request | Exact allowed origin | Set Access-Control-Allow-Credentials: true; never combine credentials with *. |
Keep WordPress permissions, nonces, and authentication in place. |
| Several approved frontends | A validated value selected from a fixed allowlist | Apply the credential rule if applicable | Never reflect an arbitrary incoming Origin; send Vary: Origin when the response changes by origin. |
The wildcard means any origin may read a response only for non-credentialed access. Browsers reject a wildcard allow-origin value when credentials are included. An Authorization request header can also trigger a preflight, so it must be named in Access-Control-Allow-Headers when the application uses it. CORS is not an authentication mechanism.
Check Apache and hosting prerequisites
Before touching the file, confirm that your hosting configuration can apply the directive. Apache controls which directives are legal in .htaccess with AllowOverride and, on newer configurations, AllowOverrideList. The Header directive belongs to the FileInfo override class. If overrides are disabled, Apache may ignore the file; if the directive is disallowed, the request can produce a 500 error.
The Header directive is supplied by mod_headers. Ask the host or Apache administrator to confirm that module is loaded and that FileInfo overrides are permitted for the site. Shared hosts often do not expose a module list or a server configuration test to account owners.
- Make a dated copy of the current
.htaccessfile before editing it. - Identify the directory that actually serves the API or assets. A file applies to its directory and descendants only when Apache has enabled
.htaccessprocessing there. - Make the smallest change possible and keep a rollback copy outside the web root.
- Check whether WordPress, a security or cache plugin, a reverse proxy, or a CDN already adds CORS headers.
Update the .htaccess file step by step
1. Put the rule in the correct directory
For a WordPress REST endpoint hosted by the same site, the document-root .htaccess is commonly the starting point. If only a separate directory serves cross-origin files, put the rule in that directory instead. A root rule can affect HTML pages, admin responses, uploads, and unrelated endpoints, so narrow placement is preferable whenever your layout allows it.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
2. Allow a public, non-credentialed resource
Use this pattern only when the response is intended to be readable by any website and the browser request does not include credentials:
<IfModule mod_headers.c>
Header always set Access-Control-Allow-Origin "*"
</IfModule>The IfModule wrapper prevents an unknown directive from being parsed when the module is absent, but it does not make CORS work. If mod_headers is not loaded, no header is added. A wildcard on every WordPress response is usually broader than necessary and can expose data that was never intended for cross-origin reading.
3. Allow one known frontend origin
For a private application hosted at one known origin, specify the complete scheme, host, and port:
<IfModule mod_headers.c>
Header always set Access-Control-Allow-Origin "https://app.example.com"
Header always set Vary "Origin"
</IfModule>Replace the example with the actual origin. Do not write a path, wildcard subdomain, or trailing slash. If your production site uses HTTPS but your test page uses HTTP, those are different origins and the test origin must be deliberately allowed or moved to HTTPS.
4. Answer preflight requests with only the needed methods and headers
Browsers send an OPTIONS preflight before many cross-origin requests, including requests using non-simple methods or headers. Add the methods and request headers that the application really accepts:
<IfModule mod_headers.c>
Header always set Access-Control-Allow-Methods "GET, POST, OPTIONS"
Header always set Access-Control-Allow-Headers "Content-Type, Authorization"
</IfModule>This example permits the three listed methods and the two listed request headers. Remove entries your endpoint does not use; do not copy the list unchanged merely because it appears in a sample. Header names are compared without regard to case, but the requested method and header must be covered by the server’s response.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
These directives add response headers; they do not by themselves guarantee that the application returns a successful response to OPTIONS. WordPress, the endpoint, or another Apache rule still needs to handle the preflight with an acceptable status. Test the actual OPTIONS response rather than assuming that adding headers completed the negotiation.
5. Enable credentials only with an explicit origin
If the frontend uses WordPress cookies or another credentialed browser request, use a specific origin and explicitly permit credentials:
<IfModule mod_headers.c>
Header always set Access-Control-Allow-Origin "https://app.example.com"
Header always set Access-Control-Allow-Credentials "true"
Header always set Vary "Origin"
Header always set Access-Control-Allow-Methods "GET, POST, OPTIONS"
Header always set Access-Control-Allow-Headers "Content-Type, Authorization"
</IfModule>On the frontend, the request must also be made in a mode that sends credentials. The server must still authenticate and authorize the user; the CORS headers only determine whether browser JavaScript may read the response. Never change the first line to * in this configuration.
6. Handle more than one approved origin safely
Apache must choose a response value from a fixed allowlist, based on a validated incoming Origin. It must not blindly copy any value supplied by the client. A dynamic allowlist also requires Vary: Origin so a cache does not serve a response generated for one origin to another origin.
When the allowlist is maintained in WordPress or application code, let that layer perform the validation and remove any competing Apache rule. When it is maintained in Apache, have the administrator implement and test an explicit allowlist rather than using a general reflection rule. If you cannot verify the validation logic, support one static origin instead.
Understand WordPress’s own CORS behavior
WordPress includes send_origin_headers(). It can handle OPTIONS requests and send access-control headers for an allowed origin, or return a 403 response when the origin is not allowed. A custom endpoint or plugin may therefore already be producing CORS headers before Apache adds yours.
Recommended Free Tools
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Inspect the final response before adding a rule. If WordPress, a plugin, a CDN, and Apache each emit Access-Control-Allow-Origin, the browser may see duplicate or conflicting values and reject the response. Keep one authoritative policy for each resource. If you move the policy to Apache, remove or disable the competing plugin setting; if the plugin must own the allowlist, avoid a broad root-level Apache rule.
Test the final response, including preflight
Use browser developer tools
- Open the page that makes the failing request and open Developer Tools.
- In the Network panel, select the request to the API or asset. Look at the final response, not only an intermediate redirect.
- Check the response headers for exactly one coherent
Access-Control-Allow-Originvalue. - If an
OPTIONSrequest appears, verify its status, allow-origin value, allowed methods, and allowed request headers. - Check whether a redirect sends the browser to a different host or scheme; the final response must satisfy CORS too.
Test a normal response with curl
Send the same origin that the browser sends:
curl -i https://www.example.com/wp-json/example/v1/items
-H "Origin: https://app.example.com"Read the response headers. For a fixed policy, the allow-origin value should be the exact frontend origin. For a public policy, it should be *. If the response contains two allow-origin headers or a comma-separated value, find and remove the duplicate source.
Test a preflight with curl
Simulate the browser’s negotiation, including the method and headers your frontend intends to send:
curl -i -X OPTIONS https://www.example.com/wp-json/example/v1/items
-H "Origin: https://app.example.com"
-H "Access-Control-Request-Method: POST"
-H "Access-Control-Request-Headers: Content-Type, Authorization"The response must allow the requesting origin and cover the requested method and header names. A successful GET response does not prove that a POST preflight works. Test the route, method, and headers used by the real frontend.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Troubleshoot the common failures
500 Internal Server Error immediately after editing
Apache is likely rejecting Header because AllowOverride or AllowOverrideList does not permit FileInfo, or mod_headers is unavailable. Restore the backup to recover the site, then ask the host to enable the directive or place the rule in the virtual-host or server configuration.
The header never appears
The file may be ignored because overrides are set to None, may be in a directory that does not serve the requested resource, or may be bypassed by a CDN or proxy that replaces the response. Confirm the request’s final host and path, verify the directory scope, and inspect the origin response separately from the cached edge response.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
There are duplicate or conflicting allow-origin values
Search the final response and then check each layer: WordPress core or a custom endpoint, security and cache plugins, CDN rules, virtual-host configuration, and .htaccess. Remove all but the one policy that should own the resource. A browser cannot choose between two different allow-origin values.
The preflight still fails
Inspect the OPTIONS response directly. Confirm that it reaches the intended server, returns an acceptable status, names the exact frontend origin, includes the requested method, and lists every non-simple request header. If WordPress returns 403, its origin allowlist is rejecting the request; update that allowlist or let WordPress remain the sole CORS layer.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchCredentials produce a browser error
Replace * with the exact origin, add Access-Control-Allow-Credentials: true, and ensure the frontend and server are using the same credential policy. A wildcard and credentialed access are incompatible.
A cache serves the wrong origin
Whenever the response changes according to the requesting origin, send Vary: Origin. Also purge or revalidate the relevant cache after changing the rule. Without the variance signal, an intermediary can reuse a response generated for a different origin.
The API is on another server
The WordPress site’s .htaccess file cannot add headers to a remote API response. Configure CORS on the API server, or route the request through a server-side component you control while preserving the API’s authentication and authorization requirements.
Security boundaries and a practical review checklist
MDN’s guidance is to specify the minimum possible number of origins and resources needed for the site to function. Treat that as a design constraint, not merely a syntax preference.
- Use
*only for public, anonymous resources that are safe for any website to read. - Use an exact origin for private frontends and for requests that include cookies or other browser credentials.
- Do not use
Access-Control-Allow-Origin: nullas a workaround; hostile documents can create anullorigin. - Validate every origin in a multi-origin allowlist instead of reflecting the request blindly.
- Allow only the methods and request headers the endpoint needs.
- Keep WordPress capabilities, nonces, API keys, and authentication checks; CORS does not replace them.
- Review redirects, cached responses, and CDN behavior, not just the first origin response.
- After deployment, test both a permitted origin and an unpermitted origin so an accidental broad rule is visible.
Configuration decision summary
| Question | Use this approach | Avoid |
|---|---|---|
| Is the resource public and anonymous? | Scope a wildcard rule to that API or asset directory. | Putting * on every WordPress response. |
| Does one known application need access? | Set its exact scheme, host, and port, with Vary: Origin. |
Adding a path, slash, or unvalidated wildcard origin. |
| Are cookies or credentialed fetches involved? | Use the exact origin and Access-Control-Allow-Credentials: true. |
Combining credentials with *. |
| Does the browser send OPTIONS first? | Return a working preflight response and list only required methods and headers. | Assuming response headers alone will make an unhandled OPTIONS request succeed. |
| Does WordPress or a plugin already set CORS? | Choose one authoritative layer and inspect the final response. | Stacking Apache, WordPress, CDN, and plugin headers. |
The reliable workflow is to back up the file, confirm FileInfo and mod_headers, scope one policy to the resource that needs it, and test both the ordinary response and the preflight. If the host cannot permit the directive, the fix belongs in Apache’s server configuration or in the application that owns the API—not in a broader, less secure wildcard rule.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
