{"id":11419,"date":"2025-04-30T12:31:19","date_gmt":"2025-04-30T06:46:19","guid":{"rendered":"https:\/\/nestnepal.com\/blog\/?p=11419"},"modified":"2026-06-22T11:56:50","modified_gmt":"2026-06-22T11:56:50","slug":"enable-cors-in-cpanel-for-cross-domain-access","status":"publish","type":"post","link":"https:\/\/nestnepal.com\/blog\/enable-cors-in-cpanel-for-cross-domain-access\/","title":{"rendered":"How to Enable CORS in cPanel: A Complete Guide for Cross-Domain Access"},"content":{"rendered":"

Updated Guide for Developers and Site Owners (2025 Edition)<\/span><\/h1>\n
What is CORS and Why Does It Matter?<\/span><\/h2>\n
<\/p>\n
If your website needs to fetch data from external APIs or other domains, you’ve likely run into Cross-Origin Resource Sharing (CORS)<\/a> errors. CORS is a browser security feature that restricts cross-origin HTTP requests. To enable your site to communicate with different origins, like pulling data from a third-party service, you\u2019ll need to manually configure your server to allow such requests.<\/span><\/p>\n
<\/p>\n
$\"CORS$ <\/p>\n
This guide will walk you step by step through enabling CORS in your cPanel-hosted website using the `.htaccess` file. Whether you’re working with JavaScript front-ends, APIs, or single-page applications (SPAs), this method is crucial for smooth integration.<\/span><\/p>\n
\u00a0Step-by-Step: How to Enable CORS in cPanel<\/span><\/h2>\n
\u00a0Prerequisites:<\/span><\/h3>\n
\n
Access to your website\u2019s <\/span>cPanel<\/b><\/li>\n
Basic familiarity with file paths (like `public_html`)<\/span><\/li>\n
Your target domain(s) for cross-origin requests<\/span><\/li>\n<\/ul>\n
Step 1: Log in to your cPanel<\/span><\/h3>\n
\n
Visit yourdomain.com\/cpanel or yourdomain.com:2083.<\/span><\/li>\n
Enter your cPanel credentials provided by your hosting provider.<\/span><\/li>\n<\/ol>\n
\u00a0Step 2: Open File Manager<\/span><\/h3>\n
\n
Inside the cPanel dashboard, locate the <\/span>File Manager<\/b> (under the “Files” section).<\/span><\/li>\n
Launch the File Manager to begin accessing your website\u2019s files.<\/span><\/li>\n<\/ol>\n
\u00a0Step 3: Navigate to Your Website Root Directory<\/span><\/h3>\n
\n
Open the <\/span>public_html<\/b> folder (or the folder containing the specific site).<\/span><\/li>\n
This is typically the root directory where `.htaccess` resides.<\/span><\/li>\n<\/ol>\n
\u00a0Step 4: Reveal Hidden Files<\/span><\/h3>\n
\n
If you don\u2019t see `.htaccess`, click <\/span>Settings<\/b> in the top-right corner of File Manager.<\/span><\/li>\n
Check “<\/span>Show Hidden Files (dotfiles)<\/b>” and hit <\/span>Save<\/b>.<\/span><\/li>\n
Still not visible? You can create a new file named `.htaccess` if it doesn\u2019t exist.<\/span><\/li>\n<\/ul>\n
\u00a0Step 5: Edit the .htaccess File<\/span><\/h3>\n
\n
Right-click on `.htaccess` and select <\/span>Edit<\/b>.<\/span><\/li>\n
If prompted by a pop-up, click <\/span>Edit<\/b> again to proceed.<\/span><\/li>\n<\/ol>\n
\u00a0Step 6: Insert CORS Configuration<\/span><\/h3>\n
Add the following lines of code into your `.htaccess` file:<\/span><\/p>\n
“`apache<\/span><\/em><\/p>\n
<IfModule mod_headers.c><\/span><\/em><\/p>\n
\u00a0\u00a0\u00a0\u00a0Header set Access-Control-Allow-Origin “”<\/span><\/em><\/p>\n*
\u00a0\u00a0\u00a0\u00a0Header set Access-Control-Allow-Methods “GET, POST, OPTIONS, DELETE, PUT”<\/span><\/em><\/p>\n
\u00a0\u00a0\u00a0\u00a0Header set Access-Control-Allow-Headers “Content-Type, Authorization”<\/span><\/em><\/p>\n
<\/IfModule><\/span><\/em><\/p>\n
“`<\/span><\/em><\/p>\n
What This Does:<\/b><\/p>\n
**Access-Control-Allow-Origin “” ` allows all domains to access your resources. Replace `` with a specific domain (`https:\/\/example.com`) for more control.<\/span><\/p>\n
\n
`Access-Control-Allow-Methods` specifies which HTTP methods are permitted.<\/span><\/li>\n
`Access-Control-Allow-Headers` defines which request headers are accepted.<\/span><\/li>\n<\/ul>\n
Security Tip<\/b>: Avoid using `”*”` for production APIs unless you’re aware of the risks. It’s safer to specify only the domains you trust.<\/span><\/p>\n
\u00a0Step 7: Save and Close<\/span><\/h3>\n
Click <\/span>Save Changes<\/b> in the editor, then close the file.<\/span><\/p>\n
\u00a0Step 8: Test If CORS Is Enabled<\/span><\/h3>\n
You can test if CORS is working properly by:<\/span><\/p>\n
\n
Opening <\/span>Developer Tools<\/b> in your browser (F12)<\/span><\/li>\n
Checking the <\/span>Network tab<\/b> and looking for the `Access-Control-Allow-Origin` header in your server\u2019s responses<\/span><\/li>\n
Using online tools like [https:\/\/www.test-cors.org](https:\/\/www.test-cors.org)<\/span><\/li>\n<\/ul>\n
If the header appears correctly, your CORS configuration is now active.<\/span><\/p>\n
\u00a0Troubleshooting Tips<\/span><\/h3>\n
-><\/span>Still not working?<\/b> Check if your server has Apache’s `mod_headers` module enabled.<\/span><\/p>\n
->U<\/span>sing a CMS like WordPress<\/a>?<\/b> Make sure caching plugins aren\u2019t interfering.<\/span><\/p>\n
-><\/span>Conflicting settings?<\/b> Ensure no overrides exist in your app code or server-level config like `MultiPHP Manager<\/a>`.<\/span><\/p>\n**
FAQs:<\/h2>\n
1. Why does my browser block external API calls?<\/h3>\n
It\u2019s a default security measure. You need to allow cross-origin access on your server.<\/p>\n
2. How can I allow requests from another domain?<\/h3>\n
By editing the .htaccess file and adding the correct headers as shown above.<\/p>\n
3. Is allowing all domains safe?<\/h3>\n
No. It\u2019s better to allow only specific trusted domains for security.<\/p>\n
4. What if it’s still not working?<\/h3>\n
Check for caching, server module status, or conflicting server-level rules.<\/p>\n
5. Can I allow access from just one domain?<\/h3>\n
Yes. Replace “*” with your specific domain in the configuration.<\/p>\n
6. Will this impact my SEO?<\/h3>\n
No. It affects functionality, not search rankings, though better UX can lead to improved SEO indirectly.<\/p>\n
Final Thoughts<\/span><\/strong><\/h2>\n
Enabling CORS through cPanel\u2019s “.htaccess” is a reliable method for granting your web apps secure access to resources across domains. From APIs to static front-end applications, this simple tweak ensures that your cross-origin requests go through without triggering security blocks.<\/span><\/p>\n
Remember, always keep security in mind, don\u2019t leave wide-open access unless your use case truly demands it. Prefer domain-specific CORS rules when building production-grade systems.<\/span>

\u00a0Step-by-Step: How to Enable CORS in cPanel<\/span><\/h2>\n\u00a0Prerequisites:<\/span><\/h3>\n\nAccess to your website\u2019s <\/span>cPanel<\/b><\/li>\nBasic familiarity with file paths (like `public_html`)<\/span><\/li>\n

\u00a0Prerequisites:<\/span><\/h3>\n\nAccess to your website\u2019s <\/span>cPanel<\/b><\/li>\nBasic familiarity with file paths (like `public_html`)<\/span><\/li>\n

Step 1: Log in to your cPanel<\/span><\/h3>\n\n Visit yourdomain.com\/cpanel or yourdomain.com:2083.<\/span><\/li>\n

1. Why does my browser block external API calls?<\/h3>\nIt\u2019s a default security measure. You need to allow cross-origin access on your server.<\/p>\n

2. How can I allow requests from another domain?<\/h3>\nBy editing the .htaccess file and adding the correct headers as shown above.<\/p>\n

3. Is allowing all domains safe?<\/h3>\nNo. It\u2019s better to allow only specific trusted domains for security.<\/p>\n

4. What if it’s still not working?<\/h3>\nCheck for caching, server module status, or conflicting server-level rules.<\/p>\n

5. Can I allow access from just one domain?<\/h3>\nYes. Replace “*” with your specific domain in the configuration.<\/p>\n

6. Will this impact my SEO?<\/h3>\nNo. It affects functionality, not search rankings, though better UX can lead to improved SEO indirectly.<\/p>\n

1. Why does my browser block external API calls?<\/h3>\n
It\u2019s a default security measure. You need to allow cross-origin access on your server.<\/p>\n

2. How can I allow requests from another domain?<\/h3>\n
By editing the .htaccess file and adding the correct headers as shown above.<\/p>\n

3. Is allowing all domains safe?<\/h3>\n
No. It\u2019s better to allow only specific trusted domains for security.<\/p>\n

4. What if it’s still not working?<\/h3>\n
Check for caching, server module status, or conflicting server-level rules.<\/p>\n

5. Can I allow access from just one domain?<\/h3>\n
Yes. Replace “*” with your specific domain in the configuration.<\/p>\n

6. Will this impact my SEO?<\/h3>\n
No. It affects functionality, not search rankings, though better UX can lead to improved SEO indirectly.<\/p>\n