WordPress already has a default URL for jQuery-WordPress application calls and it's well known as the ajaxurl. However, there are cases wherein one would need to enable Cross-Origin Resource Sharing (CORS) on it such that any hostname will be able to access using it.

My current solutions is by adding a line in /wp-includes/http.php with:

@header( 'Access-Control-Allow-Origin: *' );

Such that it will be:


function send_origin_headers() {
    $origin = get_http_origin();

    if ( is_allowed_http_origin( $origin ) ) {
        @header( 'Access-Control-Allow-Origin: ' .  $origin );
        @header( 'Access-Control-Allow-Credentials: true' );
        if ( 'OPTIONS' === $_SERVER['REQUEST_METHOD'] )
        return $origin;

    if ( 'OPTIONS' === $_SERVER['REQUEST_METHOD'] ) {
        status_header( 403 );

    return false;

It works but editing the WordPress core is not a good solution.

Is there a better way to enable CORS for the ajaxurl?


This topic contains security vulnerabilities when actually implementing it on a wordpress installation.


This question was posted during the era of Wordpress 4.3. When the Wordpress 4.4 was released with the new feature WordPress REST API, enabling CORS no longer became necessary and instead just use the rest_api_init hook to add custom REST endpoints.

  • You want to call an api right?? Kind of json.? – Sundar Aug 18 '15 at 11:31
  • @solai It will be used it to get response value from a specified action as per AJAX in WordPress Plugins – Abel Melquiades Callejo Aug 18 '15 at 11:33
  • OH.. So, You want to send request to diff domain. you want to call this url xxx.com/ajax.php from yyy.com? Right? – Sundar Aug 18 '15 at 11:46
  • That's right @solai – Abel Melquiades Callejo Aug 18 '15 at 11:52
  • 2
    If you look at source, both get_http_origin and is_allowed_http_origin have filters to let you manipulate their values. – Milo Aug 18 '15 at 14:56

Milo is correct.

For instance, go to your theme's functions.php file, and add the following:

add_filter( 'allowed_http_origins', 'add_allowed_origins' );
function add_allowed_origins( $origins ) {
    $origins[] = 'https://site1.example.com';
    $origins[] = 'https://site2.example.com';
    return $origins;

Now an ajax call from https://site1.example.com to your site's ajax url will have the appropriate Access-Control-Allow-Origin header in the response. eg.

    url: 'https://site1.example.com/wp-admin/admin-ajax.php',
    type: "POST",
    data: {
    success: function(doc) {

You can achieve it by the following code.

Open you header.php

find the following text in that file

< !DOCTYPE html>

and replace it with the following.

<?php /** @package WordPress @subpackage Default_Theme  **/
<! DOCTYPE html>

Now u can find Access-Control-Allow-Origin: * in your header.

Hope this helps..!Cheers.


The best way as far as I found, I followed this link .

Just add the origin code to the WordPress header.php or ajax functions/api file.

Link: [https://stackoverflow.com/a/25719261/5431206]


Your Answer

