How Access-Control-Max-Age works
Without it, browsers repeat the OPTIONS preflight before nearly every cross-origin request, doubling round trips. Browsers cap the value: Chrome at 2 hours (7200) and Firefox at 24 hours (86400), so larger numbers have no extra effect.
Examples
Access-Control-Max-Age: 7200Check it
curl -sI https://example.com | grep -i '^access-control-max-age:'Paste a full set of response headers into the HTTP header checker to get every header explained and common mistakes flagged.
Related headers
- Access-Control-Allow-Methods: lists the HTTP methods allowed for a cross-origin request, in answer to a preflight.
- Access-Control-Allow-Headers: lists the request headers a cross-origin request may send, in answer to a preflight.
- Cache-Control: tells browsers, CDNs and proxies whether a response may be stored, by whom, and for how long.
More cors headers
Access-Control-Allow-Origin , Access-Control-Allow-Credentials , Access-Control-Expose-Headers , Origin .
Sources
Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.
Frequently asked questions
What does the Access-Control-Max-Age header do?
The Access-Control-Max-Age response header says how many seconds a browser may cache a preflight result. Without it, browsers repeat the OPTIONS preflight before nearly every cross-origin request, doubling round trips. Browsers cap the value: Chrome at 2 hours (7200) and Firefox at 24 hours (86400), so larger numbers have no extra effect.
How do I see the Access-Control-Max-Age header?
Run "curl -sI https://example.com" to print a response’s headers, or open the Network tab in your browser’s dev tools and select the request. Paste the headers into the HTTP header checker on this site to get each one explained.