HOST101: Cors preflight blocked
What this means
The server is blocking the browser's permission check (CORS preflight), so the web app cannot reach it.
Browsers send an OPTIONS request before any cross-origin API call that carries custom headers. Something in front of this store — usually a firewall rule — is blocking OPTIONS, so the browser never sends the real request. Native apps are unaffected; the fix is server-side.
What to do
Export diagnostics and contact support. Retry after making the change above; retrying without it will fail the same way.
Your data
No order or product data is affected.
Troubleshoot
- Check the firewall (WAF) for a rule blocking the OPTIONS method and allow it on /wcpos/ REST routes.
- Some security plugins have a 'block uncommon request methods' toggle — OPTIONS must stay allowed.
- Test: an OPTIONS request to the store's REST API should not return 403.
- The desktop and mobile apps do not use CORS and will still work while this is being fixed.
Where to look
When WCPOS can save this error, it is recorded on the device that raised it. Open Store health → Logs (the heart-pulse icon at the bottom of the navigation drawer), find the entry marked with this code and expand it: the expanded row shows the plain-language reason and the context captured at the moment of failure. For a store request, that context may include the server’s own error code (serverCode), the HTTP status or the endpoint; the fields shown depend on where the failure occurred. When reporting a problem, use Copy debug info at the top of the Logs screen (Share debug info on phones and tablets) rather than screenshots: it bundles the app version, connection state and the most recent errors. Logs are kept for at most 30 days, so collect them while the problem is fresh. Also copy any browser-console error that appeared before the POS was able to write its own log entry.
Details
- Code:
HOST101(CORS_PREFLIGHT_BLOCKED) - Severity: error
- Introduced in: WCPOS 1.10.0