diff --git a/services/nginx/app/index.php b/services/nginx/app/index.php
index b7c958f3..16486ab8 100644
--- a/services/nginx/app/index.php
+++ b/services/nginx/app/index.php
@@ -8,21 +8,30 @@ ini_set('zlib.output_compression', false);
  */
 const WD = __DIR__;
 
+require_once 'config.php';
+
 /** CORS */
-header("Access-Control-Allow-Origin: *");
-header("Access-Control-Allow-Headers: Content-Type, Authorization, X-Customer-Number");
-header("Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS");
+$origin = $_SERVER['HTTP_ORIGIN'] ?? '';
+$allowed_origins = array_map('trim', explode(',', (string)($CORS ?? '*')));
+if ($CORS === '*' || ($origin && in_array($origin, $allowed_origins))) {
+    header("Access-Control-Allow-Origin: " . ($origin ?: '*'));
+    header("Access-Control-Allow-Credentials: true");
+    header("Access-Control-Allow-Headers: Content-Type, Authorization, X-Customer-Number, *");
+    header("Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS");
+}
 
 // OPTIONS requests are preflight requests for CORS, we can just return a 200 OK response
 if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
-    header('Access-Control-Allow-Origin: *');
-    header('Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS');
-    header('Access-Control-Allow-Headers: *');
-    header('Content-Type: application/json');
-    http_response_code(200);
-    exit;
+    if ($CORS === '*' || ($origin && in_array($origin, $allowed_origins))) {
+        header("Access-Control-Allow-Origin: " . ($origin ?: '*'));
+        header("Access-Control-Allow-Credentials: true");
+        header('Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS');
+        header('Access-Control-Allow-Headers: *');
+        header('Content-Type: application/json');
+        http_response_code(200);
+        exit;
+    }
 }
-require_once 'config.php';
 /** Debug */
 if ($DEBUG) {
     ini_set('display_errors', 1);
diff --git a/services/nginx/app/routes/optionsRoute.php b/services/nginx/app/routes/optionsRoute.php
index 04426b34..7f35bb0a 100644
--- a/services/nginx/app/routes/optionsRoute.php
+++ b/services/nginx/app/routes/optionsRoute.php
@@ -12,11 +12,20 @@ class optionsRoute
     {
         // When the OPTIONS method is requested, accept all using regex
         $this->options('/.*', function () {
-            header('Access-Control-Allow-Origin: *');
-            header('Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS');
-            header('Access-Control-Allow-Headers: *');
-            header('Content-Type: application/json');
-            http_response_code(200);
+            global $CORS;
+            $origin = $_SERVER['HTTP_ORIGIN'] ?? '';
+            $allowed_origins = array_map('trim', explode(',', (string)($CORS ?? '*')));
+            if ($CORS === '*' || ($origin && in_array($origin, $allowed_origins))) {
+                header("Access-Control-Allow-Origin: " . ($origin ?: '*'));
+                header("Access-Control-Allow-Credentials: true");
+                header('Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS');
+                header('Access-Control-Allow-Headers: *');
+                header('Content-Type: application/json');
+                http_response_code(200);
+            } else {
+                http_response_code(403);
+                echo json_encode(['success' => false, 'message' => 'CORS origin not allowed']);
+            }
         });
     }
 }
\ No newline at end of file
diff --git a/services/traefik/dynamic.yml b/services/traefik/dynamic.yml
index 94fa008f..77e6cf4c 100644
--- a/services/traefik/dynamic.yml
+++ b/services/traefik/dynamic.yml
@@ -79,11 +79,13 @@ http:
         accessControlMaxAge: 86400
         accessControlAllowOriginList:
           - "https://truckwash.io"
+          - "https://www.truckwash.io"
           - "https://api.truckwash.io"
           - "https://api.truckwash.io:4433"
           - "https://web.truckwash.dk"
           - "https://api.truckwash.dk"
           - "https://truckwash.dk"
+          - "https://www.truckwash.dk"
           - "https://staging.truckwash.io"
           - "http://localhost"
           - "https://localhost"