Origin Isolation Headers Scanner
Checks for missing COOP and CORP headers that isolate your site against cross-origin attacks.
What it checks
This scanner checks whether your site is missing the origin isolation headers COOP and CORP. It detects the absence of these headers that separate your page from other origins in the browser.
Why it matters
Without these headers, your page is more exposed to certain cross-origin attacks where another site tries to interact with yours or read data it should not. Origin isolation is an extra layer of protection that reduces that kind of risk.
How to fix it
Add the Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy headers in your server or CDN configuration. Start with conservative values and verify that your resources and integrations still work before tightening them.
Check it on your site
Scan your site free and see if this and 44 other checks pass, with a fix prompt for every issue.
Scan my site free