CORS policy

Hi all,

I’ve been banging my head for a week now with blocks caused by CORS policy. I have a WP multisite and I’m trying to clone the main site on subdomains. The site clones fine, except for a few resources. Here’s one of the errors displayed in the browser console:

Access to fetch at ‘https://menu.vegnavigator.it/wp-content/uploads/sites/2/2025/04/copertina-risto-gray.jpg’ from origin ‘https://test4.vegnavigator.it’ has been blocked by CORS policy: The ‘Access-Control-Allow-Origin’ header has a value ‘https://test3.vegnavigator.it’ that is not equal to the supplied origin. Have the server send the header with a valid value.

I tried putting different directives in .htaccess, but CORS keeps blocking. Here are the directives I put:

<IfModule mod_headers.c>
Header set Access-Control-Allow-Origin "*"
</IfModule>

<IfModule mod_headers.c>
    SetEnvIf Origin "https://test3\.vegnavigator\.it$" ORIGIN_OK=1
    SetEnvIf Origin "https://menu\.vegnavigator\.it$" ORIGIN_OK=1

    Header set Access-Control-Allow-Origin "%{Origin}e" env=ORIGIN_OK
</IfModule>

Unfortunately I can’t find a guideline that can solve this problem. Do you have any advice for me?

Regards,
Umberto