CORS

Why curl works but browser JavaScript may fail.

A curl request can reach a webhook directly because it is not running inside a visitor's browser. Browser JavaScript has extra cross-site safety checks.

The common fix

If direct browser JavaScript fails but curl works, send the browser request to your own website first, such as /api/contact. Your website server can then forward the alert to a redacted PINGSLAP webhook URL like https://api.pingslap.com/webhook/REDACTED.

Visitor's browser↓POST /api/contact on the same website↓Website server or reverse proxy↓PINGSLAP webhook

Why curl worked

curl sends the request from your machine or server. It is not a web page loaded from another domain, so browser CORS rules are not involved.

Why browser JavaScript failed

A page at https://www.example.com calling https://api.example-service.test is cross-origin. The browser checks whether that receiving server allows the page to call it.

Why /api/contact helped

The browser posts to the same website it is already visiting. That is same-origin. The website server receives the form data and forwards only the safe alert fields to PINGSLAP.

What CORS does not control

Browser CORS rules do not govern the server-to-server forwarding request from your website server or reverse proxy to PINGSLAP.

Recommended path

  1. Use a WordPress webhook, backend route, automation platform, or same-origin /api/contact route when possible.
  2. Keep real webhook tokens out of page source, public repositories, screenshots, and support posts.
  3. Configure receiving-server CORS only when direct browser posting is intentionally supported by that receiving service.
  4. After the route is connected, run Verify Integration.