title: Cors header is ignored by Wordpress
body: <p>I'm trying to copy some content from my site with Ajax but I'm getting a problem with my cors header. </p>
  
  <p>I'm having a WordPress-Multisite site with subdomains and the ajax call is between these. If the call is made on the same subdomain it is working fine but not if it's between different ones. In my research I added to my htaccess this (on the top):</p>
  
  <pre><code>RewriteEngine On
  &lt;IfModule mod_headers.c&gt;
      Header set Access-Control-Allow-Origin "*"
  &lt;/IfModule&gt;
  </code></pre>
  
  <p>Also notice: I' having a Linux shared server and my hoster confirmed that my mod_headers are enabled. The call is made in the backend but the htaccess should be loaded anyway right?</p>
  
  <p><strong>You can see my Ajax call below:</strong></p>
  
  <pre><code>$.ajax({
       url: window.location.protocol + '//' + window.location.hostname.replace('en.|de.', '') + '/' + admin_slug + '/network/',
       type: 'GET',
       success: function(res) {
          var data = $.parseHTML(res);  //&lt;----try with $.parseHTML().
          $(data).find( '#menu-settings' ).find( 'ul' ).each(function(){
              $( 'ul.overview_settings-list' ).append($(this).html());
          });
  
       }
  });
  </code></pre>
  
  <p><strong>But still I'm getting this error:</strong></p>
  
  <pre><code>Access to XMLHttpRequest at 'https://domain.co/dashboard/network/' (redirected from 'https://de.domain.co/dashboard/network') from origin 'https://de.domain.co' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: Redirect is not allowed for a preflight request.
  </code></pre>
  
  <pre><code>load-scripts.php?c=1&amp;load[]=jquery-core,jquery-migrate,utils&amp;ver=5.2.2:4 GET https://domain.co/dashboard/network/ net::ERR_FAILED
  </code></pre>
  
  <p><strong>EDIT Also this didn't work for me:</strong></p>
  
  <pre><code>RewriteEngine On
  &lt;IfModule mod_headers.c&gt;
     Header set Access-Control-Allow-Origin "*"
     Header set Access-Control-Allow-Headers "Content-Type"
     Header set Access-Control-Allow-Methods "GET"
  &lt;/IfModule&gt;
  </code></pre>