Security
Cross-Origin-Resource-Policy
Restricts which origins can load a resource, preventing unauthorized cross-origin reads.
Syntax
Cross-Origin-Resource-Policy: same-site | same-origin | cross-originExample
Cross-Origin-Resource-Policy: same-originDescription
Cross-Origin-Resource-Policy (CORP) tells the browser which origins can include the resource. Prevents cross-origin data leaks.
Values: same-site, same-origin, cross-origin.
Important for resources with sensitive data — without it, any website could embed your resources and extract information via side-channel attacks.
How real sites send this header
Home-page responses of 503 popular sites from the enterno.io /check catalogue, checked in the last 30 days.
4.8%
(24 of 503) send Cross-Origin-Resource-Policy.
Most common values:
same-origin— 17 sitescross-origin— 6 sites
See it on: cloudflare.com, beget.com, codepen.io, npmjs.com, abuseipdb.com
Check if your website sends this header correctly
Check your headers →