diff --git a/.env.example b/.env.example
index 09280e3..347f42f 100644
--- a/.env.example
+++ b/.env.example
@@ -13,7 +13,7 @@ PORT=8787
 # SIGNUP_FROM_EMAIL=Ditto <hello@ditto.site>
 # SIGNUP_VERIFY_URL=https://ditto.site/api-key
 # SIGNUP_TOKEN_TTL_MINUTES=30
-# SIGNUP_CORS_ORIGINS=https://ditto.site
+# SIGNUP_CORS_ORIGINS=https://ditto.site,https://www.ditto.site
 
 # ---- Database + queue (Postgres; pg-boss uses the same DB) ----
 DATABASE_URL=postgresql://postgres:postgres@localhost:5432/ditto_site
diff --git a/docs/DEPLOY.md b/docs/DEPLOY.md
index 36feee3..df67bf8 100644
--- a/docs/DEPLOY.md
+++ b/docs/DEPLOY.md
@@ -58,7 +58,7 @@ RESEND_API_KEY=re_...
 SIGNUP_FROM_EMAIL=Ditto <hello@ditto.site>   # must be a verified Resend sender/domain
 SIGNUP_VERIFY_URL=https://ditto.site/api-key
 SIGNUP_TOKEN_TTL_MINUTES=30
-SIGNUP_CORS_ORIGINS=https://ditto.site       # browser origins allowed to call signup routes
+SIGNUP_CORS_ORIGINS=https://ditto.site,https://www.ditto.site # browser origins allowed to call signup routes
 # SSRF is on by default; do NOT set SSRF_ALLOW_LOOPBACK in prod.
 ```
 
diff --git a/docs/SERVICE.md b/docs/SERVICE.md
index 0c5a004..4a1760d 100644
--- a/docs/SERVICE.md
+++ b/docs/SERVICE.md
@@ -145,7 +145,7 @@ List-then-read so a clone never floods the agent's context:
 | `SIGNUP_FROM_EMAIL` | api | — | verified sender, e.g. `Ditto <hello@ditto.site>` |
 | `SIGNUP_VERIFY_URL` | api | — | landing-page URL that receives `?token=...`, e.g. `https://ditto.site/api-key` |
 | `SIGNUP_TOKEN_TTL_MINUTES` | api | `30` | one-time email verification token lifetime |
-| `SIGNUP_CORS_ORIGINS` | api | `https://ditto.site` | comma-separated browser origins allowed to call public signup routes |
+| `SIGNUP_CORS_ORIGINS` | api | `https://ditto.site,https://www.ditto.site` | comma-separated browser origins allowed to call public signup routes |
 | `SSRF_DISABLE` | api | `false` | turn off the SSRF guard (not recommended) |
 | `SSRF_ALLOW_LOOPBACK` | api | `false` | allow cloning localhost (local dev) |
 | `S3_BUCKET` / `S3_ENDPOINT` / `S3_REGION` / `S3_ACCESS_KEY_ID` / `S3_SECRET_ACCESS_KEY` / `S3_FORCE_PATH_STYLE` / `S3_PUBLIC_URL` | api, worker | — | set `S3_BUCKET` ⇒ object storage |
diff --git a/packages/api/src/env.ts b/packages/api/src/env.ts
index 1197a39..9c7a372 100644
--- a/packages/api/src/env.ts
+++ b/packages/api/src/env.ts
@@ -60,7 +60,7 @@ export function loadEnv(): ApiEnv {
     signupFromEmail: process.env.SIGNUP_FROM_EMAIL,
     signupVerifyUrl: process.env.SIGNUP_VERIFY_URL,
     signupTokenTtlMinutes: parseInt(process.env.SIGNUP_TOKEN_TTL_MINUTES ?? "30", 10),
-    signupCorsOrigins: (process.env.SIGNUP_CORS_ORIGINS ?? "https://ditto.site").split(",").map((s) => s.trim()).filter(Boolean),
+    signupCorsOrigins: (process.env.SIGNUP_CORS_ORIGINS ?? "https://ditto.site,https://www.ditto.site").split(",").map((s) => s.trim()).filter(Boolean),
     ssrfEnabled: process.env.SSRF_DISABLE !== "true",
     ssrfAllowLoopback: process.env.SSRF_ALLOW_LOOPBACK === "true",
   };