HOST111: Cors misconfigured
What this means
The server's cross-origin (CORS) configuration is broken, so the browser refuses its responses.
The store answers, but its CORS response headers are wrong — duplicated, set to the wrong origin, or missing on error responses. The browser then hides the real answer from the web app, which also masks every other error behind a generic network failure. The fix is server-side: exactly one Access-Control-Allow-Origin, present on every status code.
Your data
No order or product data is affected.
Troubleshoot
- Look for a second CORS layer (a plugin AND the server config both adding headers) and remove one — duplicated Access-Control-Allow-Origin is a fatal browser error.
- On nginx, add_header lines skip error responses unless they end with 'always' — CORS headers must be on 4xx/5xx too.
- If a CDN or proxy adds CORS headers, make sure it does not conflict with WordPress's own.
- The desktop and mobile apps do not use CORS and will still work while this is being fixed.