Video thumbnail generator
Paste a YouTube, Vimeo, Wistia, or Loom URL to find the available thumbnail artwork and pair it with a play-button treatment for your campaign.
Use free tool Free email tool
Check whether a hosted image or font allows cross-origin access.
Paste a public asset URL to test whether this browser can fetch it with CORS, then review what that result does—and does not—mean for an HTML email.
- No signup
- Free to use
- A browser-based CORS result with response details
Free browser tool
CORS checker
The URL is requested directly from your browser; Hypermatic does not proxy the asset.
How it works
From input to useful result in three steps.
- 1
Paste the full HTTPS URL of a hosted image or font.
- 2
Run the check to attempt a cross-origin browser request.
- 3
Review the result alongside the email-specific guidance.
Need the whole email?
Design it in Figma. Export production-ready HTML with Emailify.
This free tool handles one small job. Emailify handles the complete workflow: responsive design, reusable components, breakpoint previews, and HTML export for Gmail, Outlook, Apple Mail, and 40+ email platforms.
Questions
CORS checker FAQ
Does an email image need CORS headers to display?
Usually not. Standard HTML images can render cross-origin without CORS. CORS matters when JavaScript must read the response, when a canvas processes the image, and in some hosted-font workflows.
What does a passing result prove?
It proves that this browser was allowed to fetch and read the asset cross-origin at the time of the test. It does not guarantee that every email client will load or render it.
Why might a valid URL fail?
The server may omit CORS headers, require authentication, block the request method, redirect unexpectedly, or be unavailable. Browser extensions and network policy can also interfere.
Free practical guide
How to check CORS for email images, hosted fonts, and browser tools
A CORS check tells you whether browser JavaScript can read a resource from another origin. It is relevant to canvas processing, browser-based image tools, and many hosted-font workflows, but a failed CORS check does not automatically mean a normal image will fail to display in an HTML email.
Quick answer
Paste the full public HTTPS asset URL into the free CORS checker above. A passing result means this browser was allowed to fetch and read the response cross-origin at that moment. Use the returned status and content type for diagnosis, then test the final asset in real email clients.
What is CORS and what does a CORS checker test?
Cross-Origin Resource Sharing is a browser security mechanism. A resource server uses response headers—most notably Access-Control-Allow-Origin—to state which origins may read a response through browser scripts. Without permission, the network request may occur but JavaScript is prevented from accessing the response.
A browser-based checker performs a real cross-origin request from the page you are using. It can report whether the response was readable, along with details such as status and content type when available. It cannot describe every intermediary cache, email client, or future server configuration.
| Scenario | Does CORS matter? |
|---|---|
| Normal HTML img element | Usually not for display alone. |
| Drawing a remote image to canvas | Yes, if the result must be read or downloaded. |
| Browser JavaScript fetching an asset | Yes, the response must permit the requesting origin. |
| Hosted web font | Often yes in browser workflows; email-client font support is a separate limitation. |
Do images in HTML email need CORS headers?
A standard remote image can normally display without granting CORS access because the email or browser client does not need to expose the image data to page scripts. Image blocking, proxying, privacy settings, authentication, mixed content, and an unavailable host are more common reasons for a missing campaign image.
CORS becomes relevant when a browser tool needs to inspect, transform, crop, or export the remote image through canvas. That is why an image may display in a preview yet fail when a tool tries to generate a downloadable composite or GIF.
How do you fix a failed CORS check?
The durable fix usually belongs on the server or CDN hosting the asset. Configure an appropriate Access-Control-Allow-Origin response, confirm that redirects preserve the required headers, and ensure the final URL returns the expected content type without authentication.
Do not solve a production policy problem by using an untrusted public proxy. A proxy receives the requested URL and may receive the asset content. If you control the host, configure it directly; if you do not, use an asset host designed for the required workflow.
- Use the final HTTPS URL, not a dashboard or share page.
- Check redirects as well as the final response.
- Confirm that the response is the expected image or font type.
- Retest after CDN or cache configuration changes propagate.
Why is real email-client testing still required?
CORS answers a browser-access question. Email clients introduce separate rules for image proxying, font support, CSS, authentication, caching, and user privacy settings. A passing CORS test therefore cannot guarantee that Gmail, Outlook, or Apple Mail will render the asset as intended.
Use the free checker to diagnose asset accessibility for browser workflows. Use actual email sends and client previews to validate the campaign experience your recipients will see.
Pro Bundle