---
title: "Configure CORS origins"
slug: "configure-cors-origins"
abstract: "How to configure which CORS origins are allowed in Universal Tracker."
---
# Configure CORS origins

Universal Tracker supports [Cross-origin resource sharing (CORS)](https://doc.sitecore.com/xp/en/developers/104/sitecore-experience-manager/en/cross-origin-resource-sharing--cors-.html) out of the box. By default, all origins are allowed. To configure which origins are allowed:

- Use a [Sitecore Host patch file](https://doc.sitecore.com/xp/en/developers/104/sitecore-experience-manager/en/configuration.html) to update the *AllowedOrigins* settings in the `sitecorehost.xml` configuration file. For example:

    ```xml
    <Sitecore>
        <Sitecore.Tracking.Web.Collection>
            <AllowedOrigins>https://example.origin1.net,https://example.origin2.net</AllowedOrigins>
        </Sitecore.Tracking.Web.Collection>
    </Sitecore>
    ```

To allow all origins, set *AllowedOrigins* to `*`. To deny all origins, set *AllowedOrigins* to `Null`.

> [!note]
> Calls from the site where you have deployed Universal Tracker are always allowed, even if you set *AllowedOrigins* to `Null`.