CORS errors in sGTM are usually one of six specific failures. The browser console messages are technical and the names overlap, so it helps to recognise them by symptom rather than text.

1. "Preflight request did not succeed"

Cause: your tagging server is not responding to OPTIONS requests. Browsers send a preflight OPTIONS for any non-simple POST (anything with a custom header or non-form-encoded body).

Fix: in sGTM, the standard GA4 client handles OPTIONS automatically. If you wrote a Custom Template client, you need to add an explicit OPTIONS handler that returns a 204 with the right Access-Control-Allow-* headers.

2. "Origin is not allowed by Access-Control-Allow-Origin"

Cause: your container is responding with Access-Control-Allow-Origin: example.com when the request came from www.example.com. The values must match exactly, including subdomain.

Fix: echo the request's Origin header back in the response, or use * if your tagging server does not need to handle credentials.

3. "Credentials flag is true, but Access-Control-Allow-Credentials is not"

Cause: your client GTM is sending credentials: 'include' on the fetch call (it does this when cookies need to travel with the request), and the server is not acknowledging it.

Fix: the server must return Access-Control-Allow-Credentials: true. With this set, you cannot use * for the Allow-Origin; you must echo the actual origin.

4. "Header field X-Gtm-Server-Preview is not allowed"

Cause: the OPTIONS preflight does not list the preview header in its Access-Control-Allow-Headers response.

Fix: include x-gtm-server-preview in the Allow-Headers list. Casing does not matter; the header name does.

5. "Mixed content: page loaded over HTTPS but request to HTTP"

Cause: your tagging URL is configured with HTTP somewhere, or your custom domain SSL is not set up.

Fix: HTTPS everywhere, no exceptions. If the certificate is genuinely missing, wait for SprTags to provision it (this happens automatically within minutes of DNS resolving).

6. "CORS request did not succeed (no specific cause)"

Cause: the request never reached the server, usually due to network failure, ad blocker, or DNS issue. The browser cannot tell the difference between "blocked by extension" and "server unreachable" when CORS is involved.

Fix: open DevTools, disable extensions, retry. If it works without extensions, the cause is an ad blocker. If it still fails, check DNS resolution and that your tagging server is actually responding.