Skip to content
FixSecurityHeadersScan a site

How to add Cross-Origin-Embedder-Policy on Apache

Last updated · Reviewed by a CISSP-certified security practitioner

To add Cross-Origin-Embedder-Policy on Apache, set the header in .htaccess or httpd.conf with the value require-corp. Requires embedded resources to opt in (enables cross-origin isolation). Run apachectl configtest, then reload Apache. Then confirm it with curl -I or a free FixSecurityHeaders scan.

What does Cross-Origin-Embedder-Policy do?

COEP makes the page refuse cross-origin resources that haven't opted in via CORP or CORS. Combined with COOP it enables cross-origin isolation.

Risk if missing: Informational: mainly needed for SharedArrayBuffer and high-precision timers.

What is the Apache configuration?

Add this to .htaccess or httpd.conf:

.htaccess or httpd.conf
<IfModule mod_headers.c>
  Header always set Cross-Origin-Embedder-Policy "require-corp"
</IfModule>

How do I add it step by step?

  1. Open .htaccess or httpd.conf.
  2. Paste the Cross-Origin-Embedder-Policy configuration shown below.
  3. Run apachectl configtest, then reload Apache.
  4. Run curl -I https://yourdomain.com and look for the cross-origin-embedder-policy line.
  5. Scan your site on FixSecurityHeaders to confirm the grade improved.

How do I verify it worked?

terminal
curl -sI https://yourdomain.com | grep -i "cross-origin-embedder-policy"
# expected:
# cross-origin-embedder-policy: require-corp

Check your site now

Free scan, instant grade, exact fixes for your stack.

What are the common mistakes?

  • Easily breaks third‑party images, fonts and embeds. Consider credentialless, and only deploy if you need isolation.
  • mod_headers must be enabled (a2enmod headers).
  • Use Header always set so headers apply to redirects and errors too.

Quick reference

HeaderCross-Origin-Embedder-Policy
Recommended valuerequire-corp
StackApache
Where.htaccess or httpd.conf
ComplianceOWASP ASVS V14.4

FAQ

What value should I use for Cross-Origin-Embedder-Policy?

A safe default is require-corp. Easily breaks third‑party images, fonts and embeds. Consider credentialless, and only deploy if you need isolation.

Why isn't Cross-Origin-Embedder-Policy showing up on Apache?

mod_headers must be enabled (a2enmod headers). Also clear any CDN or page cache, and check you edited the config that actually serves your domain.

Does Cross-Origin-Embedder-Policy affect SEO or performance?

No measurable performance cost — it's a few bytes per response. It doesn't affect rankings directly, but a misconfigured policy can break page resources, so test before enforcing.

Which compliance frameworks reference Cross-Origin-Embedder-Policy?

OWASP ASVS V14.4.

Related guides