HeaderAudit

Cross-Origin-Embedder-Policy

Requires that every cross-origin resource explicitly opts in to being embedded.

Recommended value

Cross-Origin-Embedder-Policy: require-corp

What it does

COEP is the second half of cross-origin isolation. With require-corp, any cross-origin resource must send Cross-Origin-Resource-Policy permitting your origin, or the browser refuses to load it.

This breaks a lot on first deployment — every image, font and script from a third party has to cooperate. credentialless is a gentler option that loads cross-origin resources without credentials instead of blocking them.

Only pursue this if you actually need SharedArrayBuffer or precise timers. Otherwise the cost outweighs the benefit.

Sites sending this header

Found while scanning 188 well-known sites on 2026-08-04:

Check a site