Why CORS policy is not working in any browser when its header exist in response?

I’ve added Header set Access-Control-Allow-Origin "*" in apache httpd.conf but still i get CORS policy error in console.

Apache httpd.conf:

<IfModule mod_headers.c>
Header set Access-Control-Allow-Origin "*"

Console error:

Redirect from ... to ... has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin ... is therefore not allowed access.

And You can see the response headers in this image.

My website is a multisite Wordpress. I’ve tested different plugins for this purpose and also .htaccess. Everything including ajax requests from subdomains and vice versa were fine but suddenly this error happened without touching a single code on the server. Is there any solution for this error?

Submit an answer

This textbox defaults to using Markdown to format your answer.

You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

Sign In or Sign Up to Answer

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

Want to learn more? Join the DigitalOcean Community!

Join our DigitalOcean community of over a million developers for free! Get help and share knowledge in Q&A, subscribe to topics of interest, and get courses and tools that will help you grow as a developer and scale your project or business.

Can you move the header directive inside your SSL vhost in httpd.conf (or wherever you have the vhost defined:

<VirtualHost IP_ADDRESS:443>


<IfModule mod_headers.c>
Header set Access-Control-Allow-Origin "*"

Make sure that all checks out before you restart Apache:

httpd -t || apachectl -t