Cross-Origin-Embedder-Policy
Requires that every cross-origin resource explicitly opts in to being embedded.
Recommended value
Cross-Origin-Embedder-Policy: require-corp
What it does
COEP is the second half of cross-origin isolation. With require-corp, any cross-origin resource must send Cross-Origin-Resource-Policy permitting your origin, or the browser refuses to load it.
This breaks a lot on first deployment — every image, font and script from a third party has to cooperate. credentialless is a gentler option that loads cross-origin resources without credentials instead of blocking them.
Only pursue this if you actually need SharedArrayBuffer or precise timers. Otherwise the cost outweighs the benefit.
Sites sending this header
Found while scanning 188 well-known sites on 2026-08-04: