diff --git a/php/add.php b/php/add.php
index e959fdac..8c116c2e 100644
--- a/php/add.php
+++ b/php/add.php
@@ -1,12 +1,18 @@
 <?php
 if(!isset($_POST['domain'], $_POST['list'], $_POST['token']))
-    die();
+    die("Missing POST variables");
+
+// Check CORS
+if($_SERVER['HTTP_ORIGIN'] != "http://pi.hole" && $_SERVER['HTTP_ORIGIN'] != "http://${_SERVER['SERVER_ADDR']}")
+    die("Failed CORS");
+
+header("Access-Control-Allow-Origin: ${_SERVER['HTTP_ORIGIN']}");
 
 session_start();
 
 // Check CSRF token
 if(!hash_equals($_SESSION['token'], $_POST['token']))
-    die("Wrong token!");
+    die("Wrong token");
 
 switch($_POST['list']) {
     case "white":
diff --git a/php/sub.php b/php/sub.php
index b6c616e8..d2730054 100644
--- a/php/sub.php
+++ b/php/sub.php
@@ -1,12 +1,18 @@
 <?php
 if(!isset($_POST['domain'], $_POST['list'], $_POST['token']))
-    die();
+    die("Missing POST variables");
+
+// Check CORS
+if($_SERVER['HTTP_ORIGIN'] != "http://pi.hole" && $_SERVER['HTTP_ORIGIN'] != "http://${_SERVER['SERVER_ADDR']}")
+    die("Failed CORS");
+
+header("Access-Control-Allow-Origin: ${_SERVER['HTTP_ORIGIN']}");
 
 session_start();
 
 // Check CSRF token
 if(!hash_equals($_SESSION['token'], $_POST['token']))
-    die("Wrong token!");
+    die("Wrong token");
 
 switch($_POST['list']) {
     case "white":