Cross-Origin-Resource-Policy
Declares who may embed this resource, blocking speculative cross-origin reads.
Recommended value
Cross-Origin-Resource-Policy: same-origin
What it does
CORP is the mirror of COEP: it is set on the resource rather than the page embedding it. It defends against side-channel attacks that work by loading your resources cross-origin and measuring the result.
same-origin for anything private, cross-origin for assets on a CDN that genuinely need to be embeddable elsewhere. Note that this is not CORS — it does not enable cross-origin reads, it restricts embedding.
Sites sending this header
Found while scanning 188 well-known sites on 2026-08-04: