How the check works
-
Origin + credentials
We grade the Access-Control-Allow-Origin and Access-Control-Allow-Credentials pair and flag unsafe combinations such as wildcard + credentials.
-
Methods + preflight
A preflight OPTIONS call reads Allow-Methods, Allow-Headers, Expose-Headers, and Max-Age so you can see the full cross-origin surface area in one view.
-
No persistence
Submitted URLs are never logged, cached, or shared. Results live only in the current browser session.