Skip to main content
Version: 1.x

HOST101: Cors preflight blocked

What this means​

The server is blocking the browser's permission check (CORS preflight), so the web app cannot reach it.

Browsers send an OPTIONS request before any cross-origin API call that carries custom headers. Something in front of this store — usually a firewall rule — is blocking OPTIONS, so the browser never sends the real request. Native apps are unaffected; the fix is server-side.

Your data​

No order or product data is affected.

Troubleshoot​

  1. Check the firewall (WAF) for a rule blocking the OPTIONS method and allow it on /wcpos/ REST routes.
  2. Some security plugins have a 'block uncommon request methods' toggle — OPTIONS must stay allowed.
  3. Test: an OPTIONS request to the store's REST API should not return 403.
  4. The desktop and mobile apps do not use CORS and will still work while this is being fixed.

Details​

Code
HOST101 (CORS_PREFLIGHT_BLOCKED)
Severity
error
Introduced in
WCPOS 1.10.0