No cross-origin isolation headers

Why it matters

web.dev's security headers reference lists Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy among the headers recommended for all websites, and Cross-Origin-Embedder-Policy for sites that enable cross-origin isolation.

What to do

1. Look at the finding: it shows, for up to ten pages, which of the three headers each sent — here, none.
2. Try Cross-Origin-Opener-Policy: same-origin, and test pages that open or are opened by other sites, such as sign-in or payment windows.
3. Add Cross-Origin-Resource-Policy to files other sites should not load, and set Cross-Origin-Embedder-Policy only if you need cross-origin isolation, since it blocks resources that do not allow it.

When to leave it as it is: if your pages rely on windows or embeds shared with other sites and you have no need for isolation, you can leave it; the notice only records that none of the headers is sent.

What we read

We capture the final response headers of every crawled page with our own user agent and judge only whether Cross-Origin-Opener-Policy, Cross-Origin-Embedder-Policy and Cross-Origin-Resource-Policy are present; their values are retained as evidence but not evaluated by this rule.

The site is reported once when none of the three appears on any crawled page. One of them, with any value, on any one page means no finding. The result needs a complete crawl: when the crawl stopped at its page limit, or a crawled page did not answer 200, the check cannot conclude. So can a page whose headers were not captured in full.

Example & evidence

Illustrative example — one audit of a small site, not a live audit.

In an audit of https://bakery.example/, every crawled page answers with headers like:

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
X-Content-Type-Options: nosniff

No page sends any of the three checked policy headers, so the site is reported once.

Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-site

A possible correction, after testing sign-in windows and embeds: add these two headers.

Confirm & check again

Check for yourself: open the response headers of a few pages in your browser's developer tools and look specifically for Cross-Origin-Opener-Policy, Cross-Origin-Embedder-Policy or Cross-Origin-Resource-Policy.

Check again: Full audit — run a new audit of the site. The finding closes when a complete crawl, with every page answering 200 and none left out, finds one of the three headers on at least one page. A crawl cut short by its page limit cannot confirm it.

Limits & sources

The check records whether the headers are named, not what they say: Cross-Origin-Opener-Policy: unsafe-none counts as present. A clean result does not mean the site is cross-origin isolated; that is not measured, and only the final response each page gave our crawler is read.

Confidence: High because the header names are read directly from every response.

Sources

• web.dev, Security headers quick reference — lists Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy among headers recommended for all websites, and Cross-Origin-Embedder-Policy for sites that enable cross-origin isolation. Checked 28 September 2026.

Editorial review: 2 November 2026

Related

• Audited HTML pages lack nosniff — another header web.dev recommends for all websites; this separate check is currently deferred in the audit.
• Pages send no framing headers — the pages send no framing header.