Using a CORS Proxy for Stubborn IPTV Streams

If our diagnostics told you "the stream host refused the browser connection," the cause is almost always CORS: the stream's server doesn't send the header browsers require before letting a website play its video. This is a security rule the browser enforces — it has nothing to do with your connection or our player, and no setting on your end fixes it. A proxy is the only real workaround, and we deliberately don't run one ourselves.

Why we don't run a proxy for you

A proxy that relays video traffic has to pay for every byte it moves, and hosting platforms treat video-relaying proxies as a violation of their terms — running one at scale isn't something a legitimate hosting provider allows. Just as importantly, a service that reroutes and retransmits video stops being a neutral player and starts being a redistributor, which is a meaningfully different — and much riskier — legal position. We'd rather stay a tool you point at your own streams than become the middleman for other people's video.

What a personal proxy is

A CORS proxy is a tiny server that fetches a URL on your behalf and adds the missing header before handing the response back to your browser. It doesn't decode, store, or modify the video — it just relays bytes with one extra header attached. Anyone can deploy one; the free tier of Cloudflare Workers is enough for personal use.

Deploying your own (about 2 minutes)

• Create a free Cloudflare account and go to Workers & Pages → Create → Create Worker.
• Replace the default code with a short script that reads a `url` query parameter, fetches it, and returns the response with `Access-Control-Allow-Origin: *` added — Cloudflare's own Workers examples in their docs cover this exact pattern.
• Deploy. You'll get a URL like `https://your-worker.your-name.workers.dev`.
• In our player, open a failed stream's error card → "+ Use your own CORS proxy" → enter `https://your-worker.your-name.workers.dev/?url={url}` and save.

The real risk: don't use a proxy you don't control

Public "free CORS proxy" services that anyone can point at any URL are a genuine risk for IPTV specifically: an Xtream Codes stream URL carries your username and password in plain text as part of the address. Routing that through a stranger's server hands them your provider login. Only ever use a proxy you deployed yourself, or one from a source you'd trust with a password.

Your proxy setting is stored only in your own browser and is never sent to us — we have no way to see or use it.