How to add Cross-Origin-Opener-Policy on Cloudflare

Last updated November 11, 2026 · Reviewed by a CISSP-certified security practitioner

To add Cross-Origin-Opener-Policy on Cloudflare, set the header in Rules → Transform Rules → Modify Response Header (or a Worker) with the value same-origin. Isolates your window from pop-ups and openers on other sites. Purge cache, then check the response with curl -I. Then confirm it with curl -I or a free FixSecurityHeaders scan.

What does Cross-Origin-Opener-Policy do?

COOP puts your page in its own browsing context group so cross-origin windows can't get a handle to it.

Risk if missing: Cross-window attacks (XS-Leaks, tabnabbing) and Spectre-style side channels.

What is the Cloudflare configuration?

Add this to Rules → Transform Rules → Modify Response Header (or a Worker):

Rules → Transform Rules → Modify Response Header (or a Worker)

// Option A: Rules → Transform Rules → Modify Response Header → "Set static"
//   Cross-Origin-Opener-Policy: same-origin

// Option B: Cloudflare Worker
export default {
  async fetch(request, env, ctx) {
    const res = await fetch(request);
    const out = new Response(res.body, res);
    const h = out.headers;
    h.set("Cross-Origin-Opener-Policy", "same-origin");
    return out;
  },
};

How do I add it step by step?

Open Rules → Transform Rules → Modify Response Header (or a Worker).
Paste the Cross-Origin-Opener-Policy configuration shown below.
Purge cache, then check the response with curl -I.
Run curl -I https://yourdomain.com and look for the cross-origin-opener-policy line.
Scan your site on FixSecurityHeaders to confirm the grade improved.

How do I verify it worked?

terminal

curl -sI https://yourdomain.com | grep -i "cross-origin-opener-policy"
# expected:
# cross-origin-opener-policy: same-origin

Check your site now

Free scan, instant grade, exact fixes for your stack.

What are the common mistakes?

OAuth or payment pop-ups that talk back via window.opener may need same-origin-allow-popups.
Transform Rules work on all plans; Workers give full control.
Cloudflare's own HSTS setting lives under SSL/TLS → Edge Certificates.

Quick reference

Header	`Cross-Origin-Opener-Policy`
Recommended value	`same-origin`
Stack	Cloudflare
Where	Rules → Transform Rules → Modify Response Header (or a Worker)
Compliance	OWASP ASVS V14.4

FAQ

What value should I use for Cross-Origin-Opener-Policy?

A safe default is same-origin. OAuth or payment pop-ups that talk back via window.opener may need same-origin-allow-popups.

Why isn't Cross-Origin-Opener-Policy showing up on Cloudflare?

Transform Rules work on all plans; Workers give full control. Also clear any CDN or page cache, and check you edited the config that actually serves your domain.

Does Cross-Origin-Opener-Policy affect SEO or performance?

No measurable performance cost — it's a few bytes per response. It doesn't affect rankings directly, but a misconfigured policy can break page resources, so test before enforcing.

Which compliance frameworks reference Cross-Origin-Opener-Policy?

OWASP ASVS V14.4.