CORS - trouble figuring out where and when

I'm making a HotSpot, and every time I try to log it keeps saying:

>Cross-Origin-Request Blocked. The Same Origin Policy disallows reading the remote resource at http://10.5.50.1/Login. (Reason: CORS header 'Access-Control-Allow-Origin' missing).

First of, I must admit that I understand only the principle of CORS. The practical side I understand only vaguely and the documentation I have read on mozilla didn't help much. I have also read many posts here on Stack Overflow but I didn't find the anwser I am looking for.

I would like to know where the CORS headers need to be placed (HTML, PHP etc.). Additionally how and where should the PHP CORS header be stated. Also where and when should a HTML CORS header be placed. And lastly, where should I put the Apache CORS header.

I have tried various options, but just can't make it work.

The router/hotspot is hosting a login page, after a user inputs the information, two ajax posts are made. The 1st logs in the user (he gains internet access), the 2cnd sends some information to the apache server which is outside the network, where php saves some information into the database.

As I mentioned before, I only have a vague ideas how CORS are supposed to work, so any pointers, corrections, etc. are very welcome.

Also if you need any additional information, just say so. I don't know what else to provide and I didn't want to cluster the post with pointless information.

Here's the code as it currently is.

PHP

<?php
header('Access-Control-Allow-Origin: *');
header('Content-Type: application/x-www-form-urlencoded, multipart/form-data');
header('Access-Control-Allow-Methods: POST');
$host = "localhost";
$userName = "root";
$password = "";
$dbName = "baza";
// Create database connection
$DB = new mysqli ($host, $userName, $password, $dbName);
// Check connection
    if ($DB->connect_error) {
        die("Connection failed: " . $DB->connect_error);
    }
?>

HTML

$(if http-header == "Access-Control-Allow-Origin")http://realhotspot.com$(endif)
$(if http-header == "Access-Control-Allow-Origin")http://10.5.50.1/login$(endif)
$(if http-header == "Access-Control-Allow-Origin")http://10.5.50.1$(endif)
$(if http-header == "Access-Control-Allow-Origin")*$(endif)

this is specific to Mikrotik, and as far as I understand it must be set this way (still doesn't work though).

Apache

<Directory>
    AllowOverride none
    Require all denied

	#I added this
	Header set Access-Control-Allow-Origin "*"
</Directory>

#And I added this right after the </Directory>
<httpProtocol>
  <customHeaders>
    <add name="Access-Control-Allow-Origin" value="*" />
    <add name="Access-Control-Allow-Methods" value="POST, GET, OPTIONS"/>
    <add name="Access-Control-Allow-Headers" value="Authorization, Origin, X-Requested-With, Content-Type, Accept"/>
  </customHeaders>
</httpProtocol>

After I added the Apache code, it stoped working, I got this error:

>Error: Apache shutdown unexpectedly. This may be due to a blocked port, missing dependencies, improper privileges, a crash, or a shutdown by another method. Press the Logs button to view error logs and check the Windows Event Viewer for more clues If you need more help, copy and post this entire log window on the forums.

And naturally there is nothing in the logs which would inicate what's the problem.

Thank you for the help.

So after I have done some more digging, I have found out that I have set up a DNS name for Mikrotik Hotspot (which is one of the options when setting up hotspot). The AJAX calls were actually made to that website/DNS , which I do not own.

After removing the DNS name from the Hotspot setting, I don't get the message any more.

Hope this helps someone in the future.
Enjoy