WordPress already has a default URL for jQuery-WordPress application calls and it's well known as the ajaxurl. However, there are cases wherein one would need to enable Cross-Origin Resource Sharing (CORS) on it such that any hostname will be able to access using it.

My current solutions is by adding a line in /wp-includes/http.php with:

@header( 'Access-Control-Allow-Origin: *' );

Such that it will be:


function send_origin_headers() {
    $origin = get_http_origin();

    @header( 'Access-Control-Allow-Origin: *' );
    if ( is_allowed_http_origin( $origin ) ) {
        @header( 'Access-Control-Allow-Origin: ' .  $origin );
        @header( 'Access-Control-Allow-Credentials: true' );
        if ( 'OPTIONS' === $_SERVER['REQUEST_METHOD'] )
        return $origin;

    if ( 'OPTIONS' === $_SERVER['REQUEST_METHOD'] ) {
        status_header( 403 );

    return false;

It works but editing the WordPress core is not a good solution.

Is there a better way to enable CORS for the ajaxurl?


This topic contains security vulnerabilities when actually implementing it on a wordpress installation.


This question was posted during the era of Wordpress 4.3. When the Wordpress 4.4 was released with the new feature WordPress REST API, enabling CORS no longer became necessary and instead just use the rest_api_init hook to add custom REST endpoints.

  • You want to call an api right?? Kind of json.?
    – Sundar
    Aug 18, 2015 at 11:31
  • @solai It will be used it to get response value from a specified action as per AJAX in WordPress Plugins Aug 18, 2015 at 11:33
  • OH.. So, You want to send request to diff domain. you want to call this url xxx.com/ajax.php from yyy.com? Right?
    – Sundar
    Aug 18, 2015 at 11:46
  • That's right @solai Aug 18, 2015 at 11:52
  • 2
    If you look at source, both get_http_origin and is_allowed_http_origin have filters to let you manipulate their values.
    – Milo
    Aug 18, 2015 at 14:56

4 Answers 4


Milo is correct.

For instance, go to your theme's functions.php file, and add the following:

add_filter( 'allowed_http_origins', 'add_allowed_origins' );
function add_allowed_origins( $origins ) {
    $origins[] = 'https://site1.example.com';
    $origins[] = 'https://site2.example.com';
    return $origins;

Now an ajax call from https://site1.example.com to your site's ajax url will have the appropriate Access-Control-Allow-Origin header in the response. eg.

    url: 'https://site1.example.com/wp-admin/admin-ajax.php',
    type: "POST",
    data: {
    success: function(doc) {

Just add this code into your function.php, no need to update .htaccess, /wp-includes/http.php or any other core file.

function just_add_cors_http_header($headers){

    $headers['Access-Control-Allow-Origin'] = '*';

    return $headers;





You can achieve it by the following code.

Open you header.php

find the following text in that file

< !DOCTYPE html>

and replace it with the following.

<?php /** @package WordPress @subpackage Default_Theme  **/
header("Access-Control-Allow-Origin: *"); 
<! DOCTYPE html>

Now u can find Access-Control-Allow-Origin: * in your header.

Hope this helps..!Cheers.


The best way as far as I found, I followed this link .

Just add the origin code to the WordPress header.php or ajax functions/api file.

Link: [https://stackoverflow.com/a/25719261/5431206]



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.