Concurrency-limited
Up to five URLs are checked at once so a long list doesn't hammer any single server.
Paste a list of URLs and check each one, five at a time, right from your own browser — with a clear, honest explanation of what CORS lets a browser actually see.
Paste some URLs above and click "Check links" to see results here.
Up to five URLs are checked at once so a long list doesn't hammer any single server.
Every request comes straight from your machine. Nothing is proxied through a server.
Hidden-status results are never guessed at or faked — they're labeled exactly for what they are.
Test a batch of links quickly, straight from your browser.
Browser security (the same-origin policy) exists specifically to stop a webpage's JavaScript from reading responses from other sites. A cross-origin fetch either needs the target server's explicit permission through CORS headers, or it can only be sent in "no-cors" mode, which lets the request go out but hides the response entirely from your code. This tool tries the honest, informative option first and only falls back to the limited one when it has to.
When a cross-origin server sends Access-Control-Allow-Origin headers, or the URL is same-origin, the real HTTP status code and ok/fail result are shown.
When the CORS request fails, a no-cors fetch is tried. If it resolves at all, the URL is marked reachable but its status stays hidden by browser design.
If both attempts throw, the most likely causes are DNS failure, no listener on that host, a strict security policy, or an extension actively blocking the request.
A server-side link checker or a tool like curl avoids the browser's cross-origin restrictions entirely and can always read the real status code.
Questions about CORS, reachability results and privacy.
Browsers enforce the same-origin policy. A cross-origin fetch only exposes response.status when the remote server opts in with permissive CORS headers. Most ordinary websites don't send those headers, so the browser hides the status of the response entirely for security reasons.
It means a no-cors fetch to that URL resolved without a network error. The browser did get some kind of response, but because it's an opaque response, JavaScript cannot read its status code, so this tool can't tell you whether it was a 200 or a 404.
Both the CORS and no-cors fetch attempts failed outright, which usually means a DNS failure, no server listening, a strict Content-Security-Policy, an ad blocker or browser extension, or the target actively refusing the connection.
Yes. Same-origin requests, and any cross-origin server that sends permissive CORS headers, return a fully readable status code and pass/fail result instead of the hidden-status fallback.
No. Every request is made directly from your own browser to each URL you paste. This tool has no backend and never stores or transmits your list.