Security Headers Checker / Headers
Cross-Origin-Opener-Policy (COOP): isolate your window
COOP puts your page in its own browsing context group, so another site that opened your page (or that you opened) cannot reach into your window. It closes a family of cross-site leaks and, with COEP, enables cross-origin isolation.
What to send
Cross-Origin-Opener-Policy: same-origin-allow-popups
same-origin-allow-popups keeps pop-ups you open (OAuth sign-in, PayPal) working. same-origin is stricter and is what cross-origin isolation needs.
# server { } block (or a file included in every server block).
# "always" also sends the header on error and redirect responses.
add_header Cross-Origin-Opener-Policy "same-origin-allow-popups" always;Will this break anything?
- Cross-Origin-Opener-Policy: same-origin breaks pop-ups that talk back to your page (OAuth sign-in, PayPal and some payment windows); same-origin-allow-popups keeps them working.
How our grade counts it
- Coverage, up to 5 points: same-origin, same-origin-allow-popups or noopener-allow-popups; N/A for API responses
Common mistakes
- same-origin on a page that opens a sign-in or payment pop-up that reports back: the pop-up loses its link to your page.
Check your site
The checker reads Cross-Origin-Opener-Policy the way a browser applies it, alongside every other security header.
Open the Security Headers Checker