Troubleshooting
IPTV Stream Not Playing in the Browser: CORS Error and Mixed Content
If a stream address opens fine in your TV app or VLC but not in a browser-based player (a website, a PWA), the cause is almost certainly the CORS (Cross-Origin Resource Sharing) restriction or the block on loading an HTTP resource from an HTTPS page (mixed content). These are browser-specific security rules; the stream itself works.
Quick fix steps
- Paste the address into the CORS Tester and read the result.
- If the result is 'mixed content' look for the stream's HTTPS version.
- If the result is 'CORS closed' use a TV/mobile app.
- If the stream is MPEG-TS try the .m3u8 variant.
- If it is your own server add an Access-Control-Allow-Origin header.
Tools to fix the problem
In-depth explanation
What is CORS?
Browsers stop a page from reading a resource from another domain unless the resource server allows it. Stream servers often do not give this permission because they are designed only for apps and players. That is why browser players such as hls.js cannot even read the stream's playlist. TV apps and VLC are not browsers and are not subject to this rule.
Mixed content
If an HTTPS page tries to load an HTTP resource (the stream address) the browser blocks it. Because most IPTV servers offer only HTTP, browser-based viewing is limited. If the server offers an HTTPS port (which you can see with the Server Info tool) changing the addresses to HTTPS fixes it; the M3U Bulk URL Replacer does this across the whole list.
Solutions
If the stream is on your own server adding the Access-Control-Allow-Origin: * (or your site's address) header is enough. If it is the provider's server use a TV or mobile app (Göktürk IPTV, TiviMate, VLC) instead of a browser. Göktürk Web TV supports playing in the browser but server restrictions apply there too; then the stream should be played in the app.
Frequently asked questions
Why does it open in VLC?
VLC is not a browser; it is not subject to the CORS rule.
Is changing to HTTPS enough?
If the server supports HTTPS mixed content is solved; the CORS header is a separate matter.
Is using a proxy a solution?
A CORS-permitting intermediate server solves it technically but moves the stream traffic and your account to another server; watch security and legal terms.
Why does MPEG-TS not open?
Browsers do not play a .ts stream directly; HLS (.m3u8) is needed.