Security Headers Checker / Headers
Cross-Origin-Resource-Policy (CORP): who may embed your files
CORP tells the browser which sites may load this response into their pages (an image, a script, a JSON file). It protects responses from being pulled into another site's process, where speculative-execution attacks could read them.
What to send
Cross-Origin-Resource-Policy: same-site
same-site for most responses; cross-origin for files other sites are meant to embed (public images, a widget's script, fonts you serve to others).
# server { } block (or a file included in every server block).
# "always" also sends the header on error and redirect responses.
add_header Cross-Origin-Resource-Policy "same-site" always;Will this break anything?
- Cross-Origin-Resource-Policy: same-site or same-origin stops other sites from embedding your files (images, fonts, scripts). Files other sites embed on purpose need cross-origin.
How our grade counts it
- Coverage, up to 5 points: same-origin, same-site or cross-origin
Common mistakes
- same-origin on files your other subdomains or partners embed: they stop loading there.
Check your site
The checker reads Cross-Origin-Resource-Policy the way a browser applies it, alongside every other security header.
Open the Security Headers Checker