When I watch my site trough live preview the previewframe is left blank, and in the console there appears the error: `

XMLHttpRequest cannot load http://domain.com/template . No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://www.domain.com' is therefore not allowed access.

What is that?

2 Answers 2


Instead of allowing cross site access, I'd recommend that you instead just make sure that the site is only accessible through one domain (not both www.domain.com and domain.com). This will also improve your SEO ranking, since search engines will index both these domains as separate, duplicated content. You can rewrite the domain in your .htaccess, like this:

# Remove the www from the URL
RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
RewriteRule ^(.*)$ http://%1/$1 [R=301,L]

# Force the www 
# RewriteCond %{HTTP_HOST} !^www\.
# RewriteRule ^(.*)$ http://www.%{HTTP_HOST}/$1 [R=301,L]

Notice that only one of these rules should be used, if you enable both you'll get a redirection loop.

Also, make sure you use the correct domain in your Craft config.

  • I generally agree with you, but does this make sense for multi-lang configs like: domain.de or domain.com ?
    – Victor
    Jun 24, 2014 at 13:20
  • 1
    No, but there's nothing in the original question that indicates that the site is actually running two different domains for two different locales. It says that domain.com/template can't load because www.domain.com is the origin. I'd be surprised if the site in question actually needs to run on both www.domain.com and domain.com. Jun 24, 2014 at 13:28
  • That's the even better solution. I use domains with a locale segment like so: domain.com/locale. But the error wasn't the locale. I was logged in under www.domain.com/locale so the url's didn't match because I defined domain.com/locale in the gneral configuration file.
    – KSPR
    Jun 24, 2014 at 13:32
  • 1
    @Kaspar: Great you got it sorted. -- aelva: Toché ;)
    – Victor
    Jun 24, 2014 at 13:40
  • This pointed me in the right direction...I was logged in to Craft on http but Craft was requesting live preview to load https. Logging in through https solved the issue.
    – Jeff
    May 18, 2015 at 20:21

I assume you are running Craft on a multi-environment config with to different domains.

You are getting this error because modern browsers block cross-site requests, and the live-preview is probably trying to load the template from another domain.

You can tell your server to allow a cross-site requests by sending a CORS-header. This header is called Access-Control-Allow-Origin.


Try adding this to your .htaccess file:

Header add Access-Control-Allow-Origin "http://example.com"

This will allow all requests coming from example.com. To be safe add the header for each domain you use:

Header add Access-Control-Allow-Origin "http://example1.com"
Header add Access-Control-Allow-Origin "http://example2.com"
Header add Access-Control-Allow-Origin "http://example3.com"

Note: You need mod_headers activated. And if you know what you're doing, you could also set this up in: httpd.conf <VirtualHost>

  • 1
    Hi. Aelvan's solution worked. But thanks anyway :)
    – KSPR
    Jun 24, 2014 at 13:33
  • You still have to be logged in using both domains tho.
    – jlcharette
    Apr 13, 2016 at 11:39
  • This is a nice easy solution, I did not have to be logged in for this to work. Jan 24, 2018 at 19:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.