Debug HTTP responses in seconds. CORS policies, CSP directives, security headers, redirect chains, cache behavior — analyzed, graded, and explained. Just type a domain above.
# Full scan
$ curl xhttp.lol/example.com
# CORS only
$ curl xhttp.lol/example.com/cors
# Simulate a CORS request
$ curl -X POST xhttp.lol/cors -d '{"target":"https://api.example.com","origin":"https://app.example.com"}'
# Decode a browser CORS error
$ curl -X POST xhttp.lol/error -d '{"error":"No Access-Control-Allow-Origin header..."}'
$ curl xhttp.lol/example.com
# CORS only
$ curl xhttp.lol/example.com/cors
# Simulate a CORS request
$ curl -X POST xhttp.lol/cors -d '{"target":"https://api.example.com","origin":"https://app.example.com"}'
# Decode a browser CORS error
$ curl -X POST xhttp.lol/error -d '{"error":"No Access-Control-Allow-Origin header..."}'