The solution is correctly configuring the server at https://<website.com>.

The protection that CORS provides is not so much for your helper website but for the original forum. It's up to original forum to decide who uses its data, and so, it's up to them to specify so through their access control policy.

This protection, in turn, is again not for your helper website but for the users of helper website. It ensures that a user visiting helper website can easily share their information from original forum because original forum trusts helper website to some extent.

Sure, your helper website is not a public website. It's just you in your computer running some local HTML and JS in the browser. I understand that. Still, the general mechanism of CORS cannot allow that unless, again, original forum is configured to allow it.

Alternatively, if you can't get original forum to agree to configure their server to allow cross-origin access, you could try running a local server as a sort of proxy to original forum, or you might try packing your helper website as an Electron application -I can't say I'm 100% sure on this, but there used to be ways to disable CORS protection on Electron.