<p>I assume you are running Craft on a <a href="http://buildwithcraft.com/docs/multi-environment-configs" rel="nofollow">multi-environment config</a> with to different domains. </p>

<p>You are getting this error because modern browsers block cross-site requests, and the live-preview is probably trying to load the template from another domain.</p>

<p>You can tell your server to allow a cross-site requests by sending a <a href="http://en.wikipedia.org/wiki/Cross-origin_resource_sharing" rel="nofollow">CORS-header</a>. This header is called <code>Access-Control-Allow-Origin</code>.</p>

<p>.</p>

<p>Try adding this to your .htaccess file:</p>

<pre><code>Header add Access-Control-Allow-Origin "http://example.com"
</code></pre>

<p>This will allow all requests coming from example.com. To be safe add the header for each domain you use:</p>

<pre><code>Header add Access-Control-Allow-Origin "http://example1.com"
Header add Access-Control-Allow-Origin "http://example2.com"
Header add Access-Control-Allow-Origin "http://example3.com"
</code></pre>

<p>Note: You need <code>mod_headers</code> activated. And if you know what you're doing, you could also set this up in: <code>httpd.conf &lt;VirtualHost&gt;</code></p>

CC BY-SA 3.0
2014-06-24T13:33:29.733Z
Hi. Aelvan's solution worked. But thanks anyway :)
KSPR
CC BY-SA 3.0
2016-04-13T11:39:08.730Z
You still have to be logged in using both domains tho.
jlcharette
CC BY-SA 3.0
2018-01-24T19:32:19.330Z
This is a nice easy solution, I did not have to be logged in for this to work.
Dan Zuzevich
CC BY-SA 3.0
2014-06-24T12:26:40.593Z
2014-06-24T12:26:40.593Z
Victor
<p>Instead of allowing cross site access, I'd recommend that you instead just make sure that the site is only accessible through <strong>one</strong> domain (not both www.domain.com and domain.com). This will also improve your SEO ranking, since search engines will index both these domains as separate, duplicated content. You can rewrite the domain in your .htaccess, like this:</p>

<pre><code># Remove the www from the URL
RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
RewriteRule ^(.*)$ http://%1/$1 [R=301,L]

# Force the www 
# RewriteCond %{HTTP_HOST} !^www\.
# RewriteRule ^(.*)$ http://www.%{HTTP_HOST}/$1 [R=301,L]
</code></pre>

<p>Notice that only one of these rules should be used, if you enable both you'll get a redirection loop.</p>

<p>Also, make sure you use the correct domain in your Craft config.</p>

CC BY-SA 3.0
2015-05-18T20:21:23.853Z
This pointed me in the right direction...I was logged in to Craft on http but Craft was requesting live preview to load https. Logging in through https solved the issue.
Jeff
CC BY-SA 3.0
2014-06-24T13:20:55.507Z
I generally agree with you, but does this make sense for multi-lang configs like: domain.de or domain.com ?
Victor
CC BY-SA 3.0
2014-06-24T13:28:33.297Z
No, but there's nothing in the original question that indicates that the site is actually running two different domains for two different locales. It says that domain.com/template can't load because www.domain.com is the origin. I'd be surprised if the site in question actually needs to run on both www.domain.com and domain.com.
André Elvan
CC BY-SA 3.0
2014-06-24T13:32:23.033Z
That's the even better solution. I use domains with a locale segment like so: `domain.com/locale`. But the error wasn't the locale. I was logged in under `www.domain.com/locale` so the url's didn't match because I defined `domain.com/locale` in the gneral configuration file.
KSPR
CC BY-SA 3.0
2014-06-24T13:40:22.567Z
@Kaspar: Great you got it sorted. -- aelva: Toché ;)
Victor
CC BY-SA 3.0
2014-06-24T13:17:57.900Z
2014-06-24T13:17:57.900Z
André Elvan
<p>When I watch my site trough live preview the previewframe is left blank, and in the console there appears the error: `</p>

<blockquote>
  <p>XMLHttpRequest cannot load <a href="http://domain.com/template" rel="nofollow">http://domain.com/template</a> . No
  'Access-Control-Allow-Origin' header is present on the requested
  resource. Origin '<a href="http://www.domain.com" rel="nofollow">http://www.domain.com</a>' is therefore not allowed
  access.</p>
</blockquote>

<p>What is that?</p>

<control-panel>
Live Preview XMLHttpRequest error
# Live Preview XMLHttpRequest error

(Asked by: username_0 on 2014-06-24)

When I watch my site trough live preview the previewframe is left blank, and in the console there appears the error: `

> XMLHttpRequest cannot load <http://domain.com/template> . No
> 'Access-Control-Allow-Origin' header is present on the requested
> resource. Origin '<http://www.domain.com>' is therefore not allowed
> access.

What is that?

**Tags:** control-panel

---

## 2 answers

### Answer by username_4 on 2014-06-24. Score: 10 | Accepted answer

Instead of allowing cross site access, I'd recommend that you instead just make sure that the site is only accessible through one domain (not both www.domain.com and domain.com). This will also improve your SEO ranking, since search engines will index both these domains as separate, duplicated content. You can rewrite the domain in your .htaccess, like this:
# Remove the www from the URL
RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
RewriteRule ^(.*)$ http://%1/$1 [R=301,L]

# Force the www 
# RewriteCond %{HTTP_HOST} !^www\.
# RewriteRule ^(.*)$ http://www.%{HTTP_HOST}/$1 [R=301,L]

Notice that only one of these rules should be used, if you enable both you'll get a redirection loop.
Also, make sure you use the correct domain in your Craft config.

> **Comments:**
> **username_1**: I generally agree with you, but does this make sense for multi-lang configs like: domain.de or domain.com ?  
> **username_4**: No, but there's nothing in the original question that indicates that the site is actually running two different domains for two different locales. It says that domain.com/template can't load because www.domain.com is the origin. I'd be surprised if the site in question actually needs to run on both www.domain.com and domain.com.  
> **username_0**: That's the even better solution. I use domains with a locale segment like so: `domain.com/locale`. But the error wasn't the locale. I was logged in under `www.domain.com/locale` so the url's didn't match because I defined `domain.com/locale` in the gneral configuration file.  
> **username_1**: @Kaspar: Great you got it sorted. -- aelva: Toché ;)  
> **username_5**: This pointed me in the right direction...I was logged in to Craft on http but Craft was requesting live preview to load https. Logging in through https solved the issue.  

---

### Answer by username_1 on 2014-06-24. Score: 3

I assume you are running Craft on a multi-environment config with to different domains. 
You are getting this error because modern browsers block cross-site requests, and the live-preview is probably trying to load the template from another domain.
You can tell your server to allow a cross-site requests by sending a CORS-header. This header is called Access-Control-Allow-Origin.
.
Try adding this to your .htaccess file:
Header add Access-Control-Allow-Origin "http://example.com"

This will allow all requests coming from example.com. To be safe add the header for each domain you use:
Header add Access-Control-Allow-Origin "http://example1.com"
Header add Access-Control-Allow-Origin "http://example2.com"
Header add Access-Control-Allow-Origin "http://example3.com"

Note: You need mod_headers activated. And if you know what you're doing, you could also set this up in: httpd.conf

> **Comments:**
> **username_0**: Hi. Aelvan's solution worked. But thanks anyway :)  
> **username_2**: You still have to be logged in using both domains tho.  
> **username_3**: This is a nice easy solution, I did not have to be logged in for this to work.  

---

