Cross-origin isolation headers (COOP / COEP / CORP)What it checks and how to fix it

What it checks

Fetches the homepage and reads three response headers. Each counts as set only with a strong value: Cross-Origin-Opener-Policy of same-origin or same-origin-allow-popups, Cross-Origin-Embedder-Policy of require-corp or credentialless, and Cross-Origin-Resource-Policy of same-origin or same-site. All three set passes; any missing gives a warning.

Why it matters

These headers stop other sites from getting a handle on your window (COOP), stop your pages pulling in cross-origin resources that did not opt in (COEP), and stop other sites embedding your resources (CORP). Together they shut down a class of cross-site leaks and Spectre-style side-channel attacks. Cross-origin isolation is also what unlocks SharedArrayBuffer and high-resolution timers.

How to fix it

Add the headers to HTML responses. Start with COOP and CORP, which rarely break anything; COEP require-corp blocks any cross-origin image, script or iframe that does not send CORP or CORS headers, so test it first (credentialless is the gentler option).

nginx

add_header Cross-Origin-Opener-Policy "same-origin" always;
add_header Cross-Origin-Embedder-Policy "credentialless" always;
add_header Cross-Origin-Resource-Policy "same-origin" always;

Apache

Header always set Cross-Origin-Opener-Policy "same-origin"
Header always set Cross-Origin-Embedder-Policy "credentialless"
Header always set Cross-Origin-Resource-Policy "same-origin"

Cloudflare: Rules → Transform Rules → Modify Response Header → add a rule for your hostname that sets the three headers above.

Rails (config/application.rb)

config.action_dispatch.default_headers.merge!(
  "Cross-Origin-Opener-Policy" => "same-origin",
  "Cross-Origin-Embedder-Policy" => "credentialless",
  "Cross-Origin-Resource-Policy" => "same-origin"
)

If you serve assets that other sites legitimately embed (a CDN, public images), send Cross-Origin-Resource-Policy: cross-origin on those responses only.