Answers.Body: <p>I assume you are running Craft on a <a href="http://buildwithcraft.com/docs/multi-environment-configs" rel="nofollow">multi-environment config</a> with to different domains. </p>
  
  <p>You are getting this error because modern browsers block cross-site requests, and the live-preview is probably trying to load the template from another domain.</p>
  
  <p>You can tell your server to allow a cross-site requests by sending a <a href="http://en.wikipedia.org/wiki/Cross-origin_resource_sharing" rel="nofollow">CORS-header</a>. This header is called <code>Access-Control-Allow-Origin</code>.</p>
  
  <p>.</p>
  
  <p>Try adding this to your .htaccess file:</p>
  
  <pre><code>Header add Access-Control-Allow-Origin "http://example.com"
  </code></pre>
  
  <p>This will allow all requests coming from example.com. To be safe add the header for each domain you use:</p>
  
  <pre><code>Header add Access-Control-Allow-Origin "http://example1.com"
  Header add Access-Control-Allow-Origin "http://example2.com"
  Header add Access-Control-Allow-Origin "http://example3.com"
  </code></pre>
  
  <p>Note: You need <code>mod_headers</code> activated. And if you know what you're doing, you could also set this up in: <code>httpd.conf &lt;VirtualHost&gt;</code></p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2014-06-24T13:33:29.733Z
Answers.Text: Hi. Aelvan's solution worked. But thanks anyway :)
Answers.UserDisplayName: KSPR
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-04-13T11:39:08.730Z
Answers.Text: You still have to be logged in using both domains tho.
Answers.UserDisplayName: jlcharette
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2018-01-24T19:32:19.330Z
Answers.Text: This is a nice easy solution, I did not have to be logged in for this to work.
Answers.UserDisplayName: Dan Zuzevich
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2014-06-24T12:26:40.593Z
Answers.LastActivityDate: 2014-06-24T12:26:40.593Z
Answers.UserDisplayName: Victor
Answers.Body: <p>Instead of allowing cross site access, I'd recommend that you instead just make sure that the site is only accessible through <strong>one</strong> domain (not both www.domain.com and domain.com). This will also improve your SEO ranking, since search engines will index both these domains as separate, duplicated content. You can rewrite the domain in your .htaccess, like this:</p>
  
  <pre><code># Remove the www from the URL
  RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
  RewriteRule ^(.*)$ http://%1/$1 [R=301,L]
  
  # Force the www 
  # RewriteCond %{HTTP_HOST} !^www\.
  # RewriteRule ^(.*)$ http://www.%{HTTP_HOST}/$1 [R=301,L]
  </code></pre>
  
  <p>Notice that only one of these rules should be used, if you enable both you'll get a redirection loop.</p>
  
  <p>Also, make sure you use the correct domain in your Craft config.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-05-18T20:21:23.853Z
Answers.Text: This pointed me in the right direction...I was logged in to Craft on http but Craft was requesting live preview to load https. Logging in through https solved the issue.
Answers.UserDisplayName: Jeff
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2014-06-24T13:20:55.507Z
Answers.Text: I generally agree with you, but does this make sense for multi-lang configs like: domain.de or domain.com ?
Answers.UserDisplayName: Victor
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2014-06-24T13:28:33.297Z
Answers.Text: No, but there's nothing in the original question that indicates that the site is actually running two different domains for two different locales. It says that domain.com/template can't load because www.domain.com is the origin. I'd be surprised if the site in question actually needs to run on both www.domain.com and domain.com.
Answers.UserDisplayName: André Elvan
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2014-06-24T13:32:23.033Z
Answers.Text: That's the even better solution. I use domains with a locale segment like so: `domain.com/locale`. But the error wasn't the locale. I was logged in under `www.domain.com/locale` so the url's didn't match because I defined `domain.com/locale` in the gneral configuration file.
Answers.UserDisplayName: KSPR
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2014-06-24T13:40:22.567Z
Answers.Text: @Kaspar: Great you got it sorted. -- aelva: Toché ;)
Answers.UserDisplayName: Victor
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2014-06-24T13:17:57.900Z
Answers.LastActivityDate: 2014-06-24T13:17:57.900Z
Answers.UserDisplayName: André Elvan
Body: <p>When I watch my site trough live preview the previewframe is left blank, and in the console there appears the error: `</p>
  
  <blockquote>
    <p>XMLHttpRequest cannot load <a href="http://domain.com/template" rel="nofollow">http://domain.com/template</a> . No
    'Access-Control-Allow-Origin' header is present on the requested
    resource. Origin '<a href="http://www.domain.com" rel="nofollow">http://www.domain.com</a>' is therefore not allowed
    access.</p>
  </blockquote>
  
  <p>What is that?</p>
  
Tags: <control-panel>
Title: Live Preview XMLHttpRequest error
ThreadText: # Live Preview XMLHttpRequest error
  
  (Asked by: username_0 on 2014-06-24)
  
  When I watch my site trough live preview the previewframe is left blank, and in the console there appears the error: `
  
  > XMLHttpRequest cannot load <http://domain.com/template> . No
  > 'Access-Control-Allow-Origin' header is present on the requested
  > resource. Origin '<http://www.domain.com>' is therefore not allowed
  > access.
  
  What is that?
  
  **Tags:** control-panel
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_4 on 2014-06-24. Score: 10 | Accepted answer
  
  Instead of allowing cross site access, I'd recommend that you instead just make sure that the site is only accessible through **one** domain (not both www.domain.com and domain.com). This will also improve your SEO ranking, since search engines will index both these domains as separate, duplicated content. You can rewrite the domain in your .htaccess, like this:
  
  ```
  # Remove the www from the URL
  RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
  RewriteRule ^(.*)$ http://%1/$1 [R=301,L]
  
  # Force the www 
  # RewriteCond %{HTTP_HOST} !^www\.
  # RewriteRule ^(.*)$ http://www.%{HTTP_HOST}/$1 [R=301,L]
  
  ```
  
  Notice that only one of these rules should be used, if you enable both you'll get a redirection loop.
  
  Also, make sure you use the correct domain in your Craft config.
  
  > **Comments:**
  > **username_1**: I generally agree with you, but does this make sense for multi-lang configs like: domain.de or domain.com ?  
  > **username_4**: No, but there's nothing in the original question that indicates that the site is actually running two different domains for two different locales. It says that domain.com/template can't load because www.domain.com is the origin. I'd be surprised if the site in question actually needs to run on both www.domain.com and domain.com.  
  > **username_0**: That's the even better solution. I use domains with a locale segment like so: `domain.com/locale`. But the error wasn't the locale. I was logged in under `www.domain.com/locale` so the url's didn't match because I defined `domain.com/locale` in the gneral configuration file.  
  > **username_1**: @Kaspar: Great you got it sorted. -- aelva: Toché ;)  
  > **username_5**: This pointed me in the right direction...I was logged in to Craft on http but Craft was requesting live preview to load https. Logging in through https solved the issue.  
  
  ---
  
  ### Answer by username_1 on 2014-06-24. Score: 3
  
  I assume you are running Craft on a [multi-environment config](http://buildwithcraft.com/docs/multi-environment-configs) with to different domains.
  
  You are getting this error because modern browsers block cross-site requests, and the live-preview is probably trying to load the template from another domain.
  
  You can tell your server to allow a cross-site requests by sending a [CORS-header](http://en.wikipedia.org/wiki/Cross-origin_resource_sharing). This header is called `Access-Control-Allow-Origin`.
  
  .
  
  Try adding this to your .htaccess file:
  
  ```
  Header add Access-Control-Allow-Origin "http://example.com"
  
  ```
  
  This will allow all requests coming from example.com. To be safe add the header for each domain you use:
  
  ```
  Header add Access-Control-Allow-Origin "http://example1.com"
  Header add Access-Control-Allow-Origin "http://example2.com"
  Header add Access-Control-Allow-Origin "http://example3.com"
  
  ```
  
  Note: You need `mod_headers` activated. And if you know what you're doing, you could also set this up in: `httpd.conf <VirtualHost>`
  
  > **Comments:**
  > **username_0**: Hi. Aelvan's solution worked. But thanks anyway :)  
  > **username_2**: You still have to be logged in using both domains tho.  
  > **username_3**: This is a nice easy solution, I did not have to be logged in for this to work.  
  
  ---
  
  