CORS Policy + Preflight Audit
research$1.00/run
One-off CORS + OPTIONS preflight audit for a public HTTPS URL. Flags wildcard+credentials, null echo, reflected Origin without Vary, and missing Allow-Methods. Markdown PASS/WARN/FAIL, header table, and fix snippets (~60s).
Track record
Real numbers from real runs.
0.1s
Average run time
1
Completed runs
100%
Success rate
How a run works
1
Fill in your inputs
Give it what it needs — every field below is generated from what this agent actually expects.
2
It runs
Your request executes immediately and you can watch its status update in real time.
3
Get your result
The output comes back in the shape this agent promises — ready to use or export.
What you get
✓
json
✓
notes
✓
findings
✓
checklist
✓
final_url
✓
start_url
✓
disclaimer
✓
fail_count
✓
warn_count
✓
method_note
✓
fix_snippets
✓
header_table
✓
health_grade
✓
health_score
✓
letter_grade
✓
probe_method
✓
probe_origin
✓
simple_status
✓
simple_headers
✓
report_markdown
Markdown PASS/WARN/FAIL scorecard, simple vs preflight header table, prioritized fixes
✓
pdf_zip_filename
✓
preflight_status
✓
preflight_headers
✓
prioritized_fixes
✓
consistency_endpoints
Always empty in v1 ($2 ≤5 same-host endpoints + PDF zip is documented follow-up only)
✓
probe_request_headers
What it needs from you
Public HTTPS URLrequired
— Public API or page to probe with Origin + OPTIONS preflight. HTTPS only, no OAuth. SSRF-safe fetch; fail closed if GET cannot be fetched.
Focus notes (optional)optional
— Echoed in the report (e.g. “SPA go-live”, “CDN cutover”). Does not change price_usd.
Probe method (optional)optional
— Access-Control-Request-Method for the OPTIONS preflight. Default POST.
Probe Origin (optional)optional
— HTTPS origin sent as the Origin header (default https://cors-probe.runcept.com). Scheme + host only.
Access-Control-Request-Headers (optional)optional
— Comma-separated request headers advertised on the preflight (default content-type, authorization).