diff --git a/backend/Admin/jwtService.php b/backend/Admin/jwtService.php
index 7c4eb5e1..c62191cd 100644
--- a/backend/Admin/jwtService.php
+++ b/backend/Admin/jwtService.php
@@ -6,14 +6,11 @@
 require_once __DIR__ . '/../core/bootstrap.php';
 
 header('Content-Type: application/json');
-header("Access-Control-Allow-Origin: https://siromove.com");
-header("Access-Control-Allow-Methods: POST, OPTIONS");
-header("Access-Control-Allow-Headers: Content-Type, Authorization");
 
-if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
-    http_response_code(200);
-    exit;
-}
+
+
+
+
 
 // ── Rate Limiting ───────────────────────────────────────────
 $limiter = new RateLimiter($redis);
diff --git a/backend/Admin/rides/get_driver_live_pos.php b/backend/Admin/rides/get_driver_live_pos.php
index 03936c58..49173dd2 100644
--- a/backend/Admin/rides/get_driver_live_pos.php
+++ b/backend/Admin/rides/get_driver_live_pos.php
@@ -6,7 +6,7 @@
 
 require_once __DIR__ . '/../../connect.php'; // تأكد أن هذا الملف يحتوي على $con_tracking
 
-header("Access-Control-Allow-Origin: https://siromove.com");
+
 header("Content-Type: application/json; charset=UTF-8");
 
 try {
diff --git a/backend/Admin/rides/get_rides_by_status.php b/backend/Admin/rides/get_rides_by_status.php
index 94700900..f128706b 100644
--- a/backend/Admin/rides/get_rides_by_status.php
+++ b/backend/Admin/rides/get_rides_by_status.php
@@ -1,7 +1,7 @@
 <?php
 require_once __DIR__ . '/../../connect.php';
 
-header("Access-Control-Allow-Origin: https://siromove.com");
+
 header('Content-Type: application/json; charset=utf-8');
 
 try {
diff --git a/backend/core/bootstrap.php b/backend/core/bootstrap.php
index 556cc092..0d798cac 100644
--- a/backend/core/bootstrap.php
+++ b/backend/core/bootstrap.php
@@ -42,7 +42,9 @@ header("X-XSS-Protection: 1; mode=block");
 
 
 // CORS مع التحقق من المصدر المسموح
-$allowedOrigins = array_map('trim', explode(',', getenv('CORS_ALLOWED_ORIGINS') ?: 'https://siromove.com,https://admin.siromove.com'));
+$envOrigins = array_map('trim', explode(',', getenv('CORS_ALLOWED_ORIGINS') ?: ''));
+$defaultOrigins = ['https://siromove.com', 'https://admin.siromove.com', 'https://jordan-siro.intaleqapp.com', 'http://localhost', 'http://127.0.0.1'];
+$allowedOrigins = array_unique(array_merge($envOrigins, $defaultOrigins));
 $origin = $_SERVER['HTTP_ORIGIN'] ?? '';
 if (in_array($origin, $allowedOrigins)) {
     header("Access-Control-Allow-Origin: $origin");
diff --git a/backend/fix_cors.php b/backend/fix_cors.php
new file mode 100644
index 00000000..5cef2a17
--- /dev/null
+++ b/backend/fix_cors.php
@@ -0,0 +1,40 @@
+<?php
+$files = [
+    'loginAdmin.php',
+    'login.php',
+    'loginFirstTimeDriver.php',
+    'loginWallet.php',
+    'ride/rides/get_driver_location.php',
+    'ride/rides/public_track_location.php',
+    'ride/location/getUpdatedLocationForAdmin.php',
+    'Admin/jwtService.php',
+    'Admin/rides/get_driver_live_pos.php',
+    'Admin/rides/get_rides_by_status.php',
+    'loginFirstTime.php',
+    'loginJwtDriver.php'
+];
+
+foreach ($files as $file) {
+    $fullPath = __DIR__ . '/' . $file;
+    if (!file_exists($fullPath)) continue;
+    
+    $content = file_get_contents($fullPath);
+    // Remove variations of the CORS header
+    $content = preg_replace('/header\s*\(\s*[\'"]Access-Control-Allow-Origin:[^\'"]*[\'"]\s*\)\s*;/i', '', $content);
+    // Remove manually added Access-Control-Allow-Methods and Headers since bootstrap.php does it
+    $content = preg_replace('/header\s*\(\s*[\'"]Access-Control-Allow-Methods:[^\'"]*[\'"]\s*\)\s*;/i', '', $content);
+    $content = preg_replace('/header\s*\(\s*[\'"]Access-Control-Allow-Headers:[^\'"]*[\'"]\s*\)\s*;/i', '', $content);
+    // Remove manually added Access-Control-Allow-Credentials
+    $content = preg_replace('/header\s*\(\s*[\'"]Access-Control-Allow-Credentials:[^\'"]*[\'"]\s*\)\s*;/i', '', $content);
+    // Remove the OPTIONS check since bootstrap.php handles it
+    $content = preg_replace('/if\s*\(\$_SERVER\[\'REQUEST_METHOD\'\]\s*===\s*\'OPTIONS\'\)\s*\{\s*http_response_code\(\d+\);\s*exit;\s*\}/i', '', $content);
+    
+    // Also remove any remaining Access-Control headers in variables (like the one in loginAdmin)
+    $content = preg_replace('/if\s*\(\$isLocal\s*\|\|\s*in_array\(\$requestOrigin,\s*\$allowedOrigins,\s*true\)\)\s*\{[^}]+\}\s*else\s*\{[^}]+\}/i', '', $content);
+
+    // Some files check if $_SERVER['REQUEST_METHOD'] == 'OPTIONS' in different format
+    $content = preg_replace('/if\s*\(\s*\$_SERVER\[\'REQUEST_METHOD\'\]\s*==\s*\'OPTIONS\'\s*\)\s*\{\s*http_response_code\(\d+\);\s*exit;\s*\}/i', '', $content);
+
+    file_put_contents($fullPath, $content);
+    echo "Fixed $file\n";
+}
diff --git a/backend/login.php b/backend/login.php
index 92f1679e..c68d83c9 100644
--- a/backend/login.php
+++ b/backend/login.php
@@ -6,14 +6,11 @@
 require_once __DIR__ . '/core/bootstrap.php';
 
 header('Content-Type: application/json');
-header('Access-Control-Allow-Origin: https://siromove.com');
-header('Access-Control-Allow-Methods: POST, OPTIONS');
-header('Access-Control-Allow-Headers: Content-Type, Authorization, X-Device-FP');
 
-if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
-    http_response_code(200);
-    exit;
-}
+
+
+
+
 
 $startTime = microtime(true);
 
diff --git a/backend/loginAdmin.php b/backend/loginAdmin.php
index 33b26572..edf11a7e 100644
--- a/backend/loginAdmin.php
+++ b/backend/loginAdmin.php
@@ -17,20 +17,13 @@ $allowedOrigins = array_filter([
 $requestOrigin = $_SERVER['HTTP_ORIGIN'] ?? '';
 if (!empty($requestOrigin)) {
     $isLocal = strpos($requestOrigin, 'http://localhost') === 0 || strpos($requestOrigin, 'http://127.0.0.1') === 0;
-    if ($isLocal || in_array($requestOrigin, $allowedOrigins, true)) {
-        header("Access-Control-Allow-Origin: " . $requestOrigin);
-    } else {
-        header("Access-Control-Allow-Origin: https://siromove.com");
-    }
+    
 }
-header("Access-Control-Allow-Credentials: true");
-header("Access-Control-Allow-Methods: POST, OPTIONS");
-header("Access-Control-Allow-Headers: Content-Type, Authorization");
 
-if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
-    http_response_code(200);
-    exit;
-}
+
+
+
+
 
 // ── Rate Limiting ───────────────────────────────────────────
 $limiter = new RateLimiter($redis);
diff --git a/backend/loginFirstTime.php b/backend/loginFirstTime.php
index b334120a..832048cc 100644
--- a/backend/loginFirstTime.php
+++ b/backend/loginFirstTime.php
@@ -9,14 +9,11 @@ ini_set('display_startup_errors', 1);
 error_reporting(E_ALL);
 
 header('Content-Type: application/json');
-header('Access-Control-Allow-Origin: https://siromove.com');
-header('Access-Control-Allow-Methods: POST, OPTIONS');
-header('Access-Control-Allow-Headers: Content-Type, Authorization');
 
-if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
-    http_response_code(200);
-    exit;
-}
+
+
+
+
 
 try {
     $limiter = new RateLimiter($redis);
diff --git a/backend/loginFirstTimeDriver.php b/backend/loginFirstTimeDriver.php
index edc5d4b7..e024c30f 100644
--- a/backend/loginFirstTimeDriver.php
+++ b/backend/loginFirstTimeDriver.php
@@ -7,14 +7,11 @@
 require_once __DIR__ . '/core/bootstrap.php';
 
 header('Content-Type: application/json');
-header('Access-Control-Allow-Origin: https://siromove.com');
-header('Access-Control-Allow-Methods: POST, OPTIONS');
-header('Access-Control-Allow-Headers: Content-Type, Authorization');
 
-if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
-    http_response_code(200);
-    exit;
-}
+
+
+
+
 
 try {
     $limiter = new RateLimiter($redis);
diff --git a/backend/loginJwtDriver.php b/backend/loginJwtDriver.php
index 37c9e96f..13d71849 100644
--- a/backend/loginJwtDriver.php
+++ b/backend/loginJwtDriver.php
@@ -6,14 +6,11 @@
 require_once __DIR__ . '/core/bootstrap.php';
 
 header('Content-Type: application/json; charset=utf-8');
-header('Access-Control-Allow-Origin: https://siromove.com');
-header('Access-Control-Allow-Methods: POST, OPTIONS');
-header('Access-Control-Allow-Headers: Content-Type, Authorization, X-Device-FP');
 
-if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
-    http_response_code(204);
-    exit;
-}
+
+
+
+
 
 $startTime = microtime(true);
 
diff --git a/backend/loginWallet.php b/backend/loginWallet.php
index d4a2401d..45df7bec 100644
--- a/backend/loginWallet.php
+++ b/backend/loginWallet.php
@@ -6,14 +6,11 @@
 require_once __DIR__ . '/core/bootstrap.php';
 
 header('Content-Type: application/json');
-header('Access-Control-Allow-Origin: https://siromove.com');
-header('Access-Control-Allow-Methods: POST, OPTIONS');
-header('Access-Control-Allow-Headers: Content-Type, Authorization, X-Device-FP');
 
-if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
-    http_response_code(200);
-    exit;
-}
+
+
+
+
 
 try {
     $limiter = new RateLimiter($redis);
diff --git a/backend/ride/location/getUpdatedLocationForAdmin.php b/backend/ride/location/getUpdatedLocationForAdmin.php
index 5f0df8c7..e9c09087 100644
--- a/backend/ride/location/getUpdatedLocationForAdmin.php
+++ b/backend/ride/location/getUpdatedLocationForAdmin.php
@@ -5,7 +5,7 @@
 
 require_once __DIR__ . '/../../connect.php';
 
-header("Access-Control-Allow-Origin: https://siromove.com");
+
 header("Content-Type: application/json; charset=UTF-8");
 
 // تفعيل إظهار الأخطاء لمعرفة مشكلة الكتابة
diff --git a/backend/ride/rides/get_driver_location.php b/backend/ride/rides/get_driver_location.php
index 2e75a084..220fc75d 100644
--- a/backend/ride/rides/get_driver_location.php
+++ b/backend/ride/rides/get_driver_location.php
@@ -4,7 +4,7 @@
 require_once __DIR__ . '/../../get_connect.php';
 
 // السماح بالوصول من أي دومين (لأن الرابط سيفتح في متصفح العميل)
-header("Access-Control-Allow-Origin: https://siromove.com");
+
 header("Content-Type: application/json; charset=UTF-8");
 
     $rideID = filter_input(INPUT_GET, 'id', FILTER_SANITIZE_NUMBER_INT);
diff --git a/backend/ride/rides/public_track_location.php b/backend/ride/rides/public_track_location.php
index c12c9472..9f15ff1e 100644
--- a/backend/ride/rides/public_track_location.php
+++ b/backend/ride/rides/public_track_location.php
@@ -13,8 +13,8 @@ while (ob_get_level()) {
 // ابدأ مخزناً جديداً ونظيفاً لهذا الملف فقط
 ob_start();
 
-header("Access-Control-Allow-Origin: https://siromove.com");
-header("Access-Control-Allow-Methods: GET");
+
+
 header("Content-Type: application/json; charset=UTF-8");
 
 function sendError($message, $code = 400, $extra = []) {
diff --git a/dashboard/siro-admin/flutter_bootstrap.js b/dashboard/siro-admin/flutter_bootstrap.js
index 3194f8c7..96cae372 100644
--- a/dashboard/siro-admin/flutter_bootstrap.js
+++ b/dashboard/siro-admin/flutter_bootstrap.js
@@ -37,6 +37,6 @@ _flutter.buildConfig = {"engineRevision":"6c0baaebf70e0148f485f27d5616b3d3382da7
 
 _flutter.loader.load({
   serviceWorkerSettings: {
-    serviceWorkerVersion: "2630941020" /* Flutter's service worker is deprecated and will be removed in a future Flutter release. */
+    serviceWorkerVersion: "1218528987" /* Flutter's service worker is deprecated and will be removed in a future Flutter release. */
   }
 });
diff --git a/dashboard/siro-admin/index.html b/dashboard/siro-admin/index.html
index 5aadfae1..02ad033b 100644
--- a/dashboard/siro-admin/index.html
+++ b/dashboard/siro-admin/index.html
@@ -14,7 +14,7 @@
     This is a placeholder for base href that will be replaced by the value of
     the `--base-href` argument provided to `flutter build`.
   -->
-  <base href="/dashboard/siro-admin/">
+  <base href="/">
 
   <meta charset="UTF-8">
   <meta content="IE=Edge" http-equiv="X-UA-Compatible">