Cross-Origin-Opener-Policy
Isolates the browsing context to prevent cross-origin attacks like Spectre from accessing sensitive data.
Syntax
Cross-Origin-Opener-Policy: unsafe-none | same-origin-allow-popups | same-originExample
Cross-Origin-Opener-Policy: same-originDescription
Cross-Origin-Opener-Policy (COOP) controls whether a top-level document shares a browsing context with cross-origin documents. Defense against Spectre-type side-channel attacks.
Values: unsafe-none (default), same-origin-allow-popups, same-origin (full isolation).
Often used with Cross-Origin-Embedder-Policy (COEP) to achieve cross-origin isolation, enabling SharedArrayBuffer and high-resolution timers.
How real sites send this header
Home-page responses of 502 popular sites from the enterno.io /check catalogue, checked in the last 30 days.
8.0%
(40 of 502) send Cross-Origin-Opener-Policy.
Most common values:
same-origin— 31 sitessame-origin-allow-popups— 4 sitesunsafe-none— 4 sites
See it on: cloudflare.com, beget.com, angular.dev, codepen.io, joomla.org
Check if your website sends this header correctly
Check your headers →