# HOST111: Cors misconfigured

## What this means[​](#what-this-means "直接链接到 What this means")

The server's cross-origin (CORS) configuration is broken, so the browser refuses its responses.

The store answers, but its CORS response headers are wrong — duplicated, set to the wrong origin, or missing on error responses. The browser then hides the real answer from the web app, which also masks every other error behind a generic network failure. The fix is server-side: exactly one Access-Control-Allow-Origin, present on every status code.

## What to do[​](#what-to-do "直接链接到 What to do")

Export diagnostics and contact support. Retry after making the change above; retrying without it will fail the same way.

## Your data[​](#your-data "直接链接到 Your data")

No order or product data is affected.

## Troubleshoot[​](#troubleshoot "直接链接到 Troubleshoot")

1. Look for a second CORS layer (a plugin AND the server config both adding headers) and remove one — duplicated Access-Control-Allow-Origin is a fatal browser error.
2. On nginx, add\_header lines skip error responses unless they end with 'always' — CORS headers must be on 4xx/5xx too.
3. If a CDN or proxy adds CORS headers, make sure it does not conflict with WordPress's own.
4. The desktop and mobile apps do not use CORS and will still work while this is being fixed.

## Where to look[​](#where-to-look "直接链接到 Where to look")

When WCPOS can save this error, it is recorded on the device that raised it. Open **Store health → Logs** (the heart-pulse icon at the bottom of the navigation drawer), find the entry marked with this code and expand it: the expanded row shows the plain-language reason and the context captured at the moment of failure. For a store request, that context may include the server’s own error code (`serverCode`), the HTTP `status` or the `endpoint`; the fields shown depend on where the failure occurred. When reporting a problem, use **Copy debug info** at the top of the Logs screen (**Share debug info** on phones and tablets) rather than screenshots: it bundles the app version, connection state and the most recent errors. Logs are kept for at most 30 days, so collect them while the problem is fresh. Also copy any browser-console error that appeared before the POS was able to write its own log entry.

## Details[​](#details "直接链接到 Details")

* **Code:** `HOST111` (`CORS_MISCONFIGURED`)
* **Severity:** error
* **Introduced in:** WCPOS 1.10.0