Craft CMS Stack Exchange is a question and answer site for administrators, end users, developers and designers for Craft CMS. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When I watch my site trough live preview the previewframe is left blank, and in the console there appears the error: `

XMLHttpRequest cannot load . No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin '' is therefore not allowed access.

What is that?

share|improve this question
up vote 7 down vote accepted

Instead of allowing cross site access, I'd recommend that you instead just make sure that the site is only accessible through one domain (not both and This will also improve your SEO ranking, since search engines will index both these domains as separate, duplicated content. You can rewrite the domain in your .htaccess, like this:

# Remove the www from the URL
RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
RewriteRule ^(.*)$ http://%1/$1 [R=301,L]

# Force the www 
# RewriteCond %{HTTP_HOST} !^www\.
# RewriteRule ^(.*)$ http://www.%{HTTP_HOST}/$1 [R=301,L]

Notice that only one of these rules should be used, if you enable both you'll get a redirection loop.

Also, make sure you use the correct domain in your Craft config.

share|improve this answer
I generally agree with you, but does this make sense for multi-lang configs like: or ? – Victor In Jun 24 '14 at 13:20
No, but there's nothing in the original question that indicates that the site is actually running two different domains for two different locales. It says that can't load because is the origin. I'd be surprised if the site in question actually needs to run on both and – André Elvan Jun 24 '14 at 13:28
That's the even better solution. I use domains with a locale segment like so: But the error wasn't the locale. I was logged in under so the url's didn't match because I defined in the gneral configuration file. – KSPR Jun 24 '14 at 13:32
@Kaspar: Great you got it sorted. -- aelva: Toché ;) – Victor In Jun 24 '14 at 13:40
This pointed me in the right direction...I was logged in to Craft on http but Craft was requesting live preview to load https. Logging in through https solved the issue. – jlbruno May 18 '15 at 20:21

I assume you are running Craft on a multi-environment config with to different domains.

You are getting this error because modern browsers block cross-site requests, and the live-preview is probably trying to load the template from another domain.

You can tell your server to allow a cross-site requests by sending a CORS-header. This header is called Access-Control-Allow-Origin.


Try adding this to your .htaccess file:

Header add Access-Control-Allow-Origin ""

This will allow all requests coming from To be safe add the header for each domain you use:

Header add Access-Control-Allow-Origin ""
Header add Access-Control-Allow-Origin ""
Header add Access-Control-Allow-Origin ""

Note: You need mod_headers activated. And if you know what you're doing, you could also set this up in: httpd.conf <VirtualHost>

share|improve this answer
Hi. Aelvan's solution worked. But thanks anyway :) – KSPR Jun 24 '14 at 13:33
You still have to be logged in using both domains tho. – JCharette Apr 13 at 11:39

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.