Title: get_allowed_http_origins
Published: April 25, 2014
Last modified: August 20, 2026

---

# get_allowed_http_origins(): string[]

## In this article

 * [Return](https://developer.wordpress.org/reference/functions/get_allowed_http_origins/?output_format=md#return)
 * [Source](https://developer.wordpress.org/reference/functions/get_allowed_http_origins/?output_format=md#source)
 * [Hooks](https://developer.wordpress.org/reference/functions/get_allowed_http_origins/?output_format=md#hooks)
 * [Related](https://developer.wordpress.org/reference/functions/get_allowed_http_origins/?output_format=md#related)
 * [Changelog](https://developer.wordpress.org/reference/functions/get_allowed_http_origins/?output_format=md#changelog)

[ Back to top](https://developer.wordpress.org/reference/functions/get_allowed_http_origins/?output_format=md#wp--skip-link--target)

Retrieves list of allowed HTTP origins.

## 󠀁[Return](https://developer.wordpress.org/reference/functions/get_allowed_http_origins/?output_format=md#return)󠁿

 string[] Array of origin URLs.

## 󠀁[Source](https://developer.wordpress.org/reference/functions/get_allowed_http_origins/?output_format=md#source)󠁿

    ```php
    function get_allowed_http_origins() {
    	$admin_origin = parse_url( admin_url() );
    	$home_origin  = parse_url( home_url() );

    	// @todo Preserve port?
    	$allowed_origins = array_unique(
    		array(
    			'http://' . $admin_origin['host'],
    			'https://' . $admin_origin['host'],
    			'http://' . $home_origin['host'],
    			'https://' . $home_origin['host'],
    		)
    	);

    	/**
    	 * Changes the origin types allowed for HTTP requests.
    	 *
    	 * @since 3.4.0
    	 *
    	 * @param string[] $allowed_origins Array of allowed HTTP origins.
    	 */
    	return apply_filters( 'allowed_http_origins', $allowed_origins );
    }
    ```

[View all references](https://developer.wordpress.org/reference/files/wp-includes/http.php/)
[View on Trac](https://core.trac.wordpress.org/browser/tags/7.1/src/wp-includes/http.php#L448)
[View on GitHub](https://github.com/WordPress/wordpress-develop/blob/7.1/src/wp-includes/http.php#L448-L470)

## 󠀁[Hooks](https://developer.wordpress.org/reference/functions/get_allowed_http_origins/?output_format=md#hooks)󠁿

 [apply_filters( ‘allowed_http_origins’, string[] $allowed_origins )](https://developer.wordpress.org/reference/hooks/allowed_http_origins/)

Changes the origin types allowed for HTTP requests.

## 󠀁[Related](https://developer.wordpress.org/reference/functions/get_allowed_http_origins/?output_format=md#related)󠁿

| Uses | Description | 
| [admin_url()](https://developer.wordpress.org/reference/functions/admin_url/)`wp-includes/link-template.php` |

Retrieves the URL to the admin area for the current site.

  | 
| [home_url()](https://developer.wordpress.org/reference/functions/home_url/)`wp-includes/link-template.php` |

Retrieves the URL for the current site where the front end is accessible.

  | 
| [apply_filters()](https://developer.wordpress.org/reference/functions/apply_filters/)`wp-includes/plugin.php` |

Calls the callback functions that have been added to a filter hook.

  |

[Show 1 more](https://developer.wordpress.org/reference/functions/get_allowed_http_origins/?output_format=md#)
[Show less](https://developer.wordpress.org/reference/functions/get_allowed_http_origins/?output_format=md#)

| Used by | Description | 
| [is_allowed_http_origin()](https://developer.wordpress.org/reference/functions/is_allowed_http_origin/)`wp-includes/http.php` |

Determines if the HTTP origin is an authorized one.

  |

## 󠀁[Changelog](https://developer.wordpress.org/reference/functions/get_allowed_http_origins/?output_format=md#changelog)󠁿

| Version | Description | 
| [3.4.0](https://developer.wordpress.org/reference/since/3.4.0/) | Introduced. |

## User Contributed Notes

You must [log in](https://login.wordpress.org/?redirect_to=https%3A%2F%2Fdeveloper.wordpress.org%2Freference%2Ffunctions%2Fget_allowed_http_origins%2F)
before being able to contribute a note or feedback.