diff --git a/backend/.env.example b/backend/.env.example
index d3a41f0..43d802d 100644
--- a/backend/.env.example
+++ b/backend/.env.example
@@ -10,7 +10,7 @@ RESET_OTP_SECRET=
 
 # ── Environment ───────────────────────────────────────────────────────────────
 APP_ENV=production
-CORS_ORIGINS=https://quantfortune.com,https://app.quantfortune.com
+CORS_ORIGINS=https://quantfortune.com,https://www.quantfortune.com,https://app.quantfortune.com,https://www.app.quantfortune.com
 
 # ── Database ──────────────────────────────────────────────────────────────────
 DATABASE_URL=postgresql://user:password@localhost:5432/quantfortune
diff --git a/backend/app/main.py b/backend/app/main.py
index 4ddd8d2..7f9e559 100644
--- a/backend/app/main.py
+++ b/backend/app/main.py
@@ -34,18 +34,20 @@ from market import router as market_router
 from paper_mtm import router as paper_mtm_router
 
 DEFAULT_PRODUCTION_ORIGINS = {
-    "https://app.quantfortune.com",
     "https://quantfortune.com",
     "https://www.quantfortune.com",
+    "https://app.quantfortune.com",
+    "https://www.app.quantfortune.com",
 }
 DEFAULT_DEV_ORIGINS = {
     "http://localhost:3000",
     "http://127.0.0.1:3000",
     "http://localhost:5173",
     "http://127.0.0.1:5173",
-    "https://app.quantfortune.com",
     "https://quantfortune.com",
     "https://www.quantfortune.com",
+    "https://app.quantfortune.com",
+    "https://www.app.quantfortune.com",
 }
 PRODUCTION_ENV_NAMES = {"prod", "production"}