CORS tester
Paste a URL and see what your browser actually does with it: whether a cross-origin `fetch` succeeds, and if it does not, which part of the CORS handshake is missing. The tool then runs the same URL through this CORX instance and gives you the call to paste.
The probes run in your browser. The proxied request goes through this instance — subject to its terms, quotas and logging, so do not paste private URLs here.
How the test works
Your browser fetches the URL up to three ways: a plain cross-origin request, the same with credentials, and one with a custom header that forces a preflight. When the plain request is blocked, an opaque `no-cors` probe runs too — it cannot be read, but completing proves the server answered, which separates missing CORS headers from an unreachable host. Browsers deliberately hide *why* a request was blocked, so the verdict is inferred from those probes, not read from an error.
Frames are a separate question
CORS decides whether `fetch` may read a response. Whether a page can be shown in an `<iframe>` is decided by the target's `X-Frame-Options` and CSP `frame-ancestors`, which CORX does not strip by default. A self-hosted key can, for a host you control.