# Let Other Sites Read Your Feeds With JavaScript

> Sends a CORS header with your RSS and Atom feeds, so web apps, widgets and dashboards on other domains can load them with fetch() instead of hitting a browser error.

- Type: PHP
- Runs: Run everywhere
- Category: [RSS Feeds](https://wpide.com/library/category/rss/)
- Tags: feeds, cors, headers
- Author: WPIDE Team
- Installs: 0
- Updated: 2026-10-28
- Page: https://wpide.com/library/feed-cors-header/

## Code

```php
// Sites allowed to read your feeds with JavaScript. '*' allows any site; or list origins such as 'https://app.example.com'.
$wpide_feed_cors_origins = array( '*' );

add_action( 'template_redirect', function () use ( $wpide_feed_cors_origins ) {
    if ( ! is_feed() || headers_sent() ) {
        return;
    }

    if ( in_array( '*', $wpide_feed_cors_origins, true ) ) {
        header( 'Access-Control-Allow-Origin: *' );
    } else {
        $origin  = isset( $_SERVER['HTTP_ORIGIN'] ) ? untrailingslashit( esc_url_raw( wp_unslash( $_SERVER['HTTP_ORIGIN'] ) ) ) : '';
        $allowed = array_map( 'untrailingslashit', $wpide_feed_cors_origins );

        header( 'Vary: Origin', false );

        if ( '' === $origin || ! in_array( $origin, $allowed, true ) ) {
            return;
        }

        header( 'Access-Control-Allow-Origin: ' . $origin );
    }

    header( 'Access-Control-Allow-Methods: GET, HEAD, OPTIONS' );
}, 1 );
```

## Notes

Set the origins list to specific sites, such as your app's address, to allow only them; feeds are public, so '*' is safe for most sites.

## How to use it

Install the free WPIDE plugin (https://wordpress.org/plugins/wpide/), find "Let Other Sites Read Your Feeds With JavaScript" in its snippet library and add it in one click; or create a new PHP snippet in WPIDE (or any code snippets plugin) and paste the code above. More snippets: https://wpide.com/library/