Skip to main content
How can we help you today?
There was a problem loading the comments.

Fix CORS errors “Access-Control-Allow-Origin missing” (Plesk/LiteSpeed)

Support Portal  »  Knowledgebase  »  Viewing Article

If your browser console shows errors like:

…your server is not sending the required CORS headers. CORS must be fixed on the server that receives the request (usually your API), not on the website that calls it.

Step 1 – Identify which URL is failing

  • Open Developer Tools → Console/Network and copy the failing request URL.
  • Check whether that URL is hosted on GARMTECH (Plesk) or on a third-party platform. If it’s third‑party, you must configure CORS there.

Step 2 – Decide what should be allowed (keep it strict)

For security, allow only the specific origins you need (for example, https://example.com and https://www.example.com).

Do not use * (wildcard) if you send cookies/Authorization headers (credentials).

Step 3 – Add CORS headers on GARMTECH Hosting (Plesk / LiteSpeed)

On GARMTECH Hosting (LiteSpeed), standard Apache-style .htaccess rules are supported.

Option A – Add headers in .htaccess (common case)

  1. In Plesk, open Files for the domain.
  2. Open the directory that serves the API (often httpdocs or a subfolder).
  3. Create or edit the file .htaccess.
  4. Add (example):
<IfModule mod_headers.c>
  Header always set Access-Control-Allow-Origin "https://example.com"
  Header always set Access-Control-Allow-Methods "GET, POST, PUT, PATCH, DELETE, OPTIONS"
  Header always set Access-Control-Allow-Headers "Content-Type, Authorization"
</IfModule>

Handle preflight (OPTIONS) requests

Many APIs require an OPTIONS response for “preflight” checks. If your application does not handle OPTIONS, you can add a simple rule:

RewriteEngine On
RewriteCond %{REQUEST_METHOD} OPTIONS
RewriteRule ^(.*)$ $1 [R=204,L]

Note: Some frameworks must handle preflight inside the application. If the rule above does not work, configure OPTIONS handling in your API code.

Step 4 – Test again

  • Clear browser cache or test in an incognito window.
  • Verify that the response now includes Access-Control-Allow-Origin.

Common mistakes

  • Adding headers on the wrong server (website instead of API).
  • Using * together with Access-Control-Allow-Credentials: true (this is not allowed by browsers).
  • Forgetting to include OPTIONS in allowed methods.
Share via
Did you find this article useful?  

Related Articles

Comments

Add Comment

Replying to  

Categories