Security Headers Checker / Headers
Cross-Origin-Embedder-Policy (COEP) and cross-origin isolation
COEP makes the page refuse cross-origin resources that have not opted in (with CORP or CORS). With COOP same-origin it makes the page cross-origin isolated, which browsers require for SharedArrayBuffer and high-resolution timers.
What to do
Send COEP only when you need isolation: Cross-Origin-Opener-Policy: same-origin plus Cross-Origin-Embedder-Policy: credentialless (gentler) or require-corp. Our grade does not require it.
Common mistakes
- COEP without COOP same-origin: no isolation, and embeds may break anyway.
- require-corp on pages with third-party images or frames that send no CORP: they disappear.
Check your site
The checker reads Cross-Origin-Embedder-Policy the way a browser applies it, alongside every other security header.
Open the Security Headers Checker