How to add Cross-Origin-Resource-Policy on IIS

Last updated November 11, 2026 · Reviewed by a CISSP-certified security practitioner

To add Cross-Origin-Resource-Policy on IIS, set the header in web.config with the value same-origin. Stops other sites from loading your resources. Save web.config; IIS applies it on the next request. Recycle the app pool if needed. Then confirm it with curl -I or a free FixSecurityHeaders scan.

What does Cross-Origin-Resource-Policy do?

CORP tells browsers which origins may embed your images, scripts and other resources.

Risk if missing: Other sites can embed your resources and use side channels to leak data.

What is the IIS configuration?

Add this to web.config:

web.config

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
  <system.webServer>
    <httpProtocol>
      <customHeaders>
        <add name="Cross-Origin-Resource-Policy" value="same-origin" />
      </customHeaders>
    </httpProtocol>
  </system.webServer>
</configuration>

How do I add it step by step?

Open web.config.
Paste the Cross-Origin-Resource-Policy configuration shown below.
Save web.config; IIS applies it on the next request. Recycle the app pool if needed.
Run curl -I https://yourdomain.com and look for the cross-origin-resource-policy line.
Scan your site on FixSecurityHeaders to confirm the grade improved.

How do I verify it worked?

terminal

curl -sI https://yourdomain.com | grep -i "cross-origin-resource-policy"
# expected:
# cross-origin-resource-policy: same-origin

Check your site now

Free scan, instant grade, exact fixes for your stack.

What are the common mistakes?

Public CDNs and assets meant for embedding should use cross-origin.
Headers in web.config apply to every response from that site.
Removing the Server header requires removeServerHeader (IIS 10+) or URL Rewrite.

Quick reference

Header	`Cross-Origin-Resource-Policy`
Recommended value	`same-origin`
Stack	IIS
Where	web.config
Compliance	OWASP ASVS V14.4

FAQ

What value should I use for Cross-Origin-Resource-Policy?

A safe default is same-origin. Public CDNs and assets meant for embedding should use cross-origin.

Why isn't Cross-Origin-Resource-Policy showing up on IIS?

Headers in web.config apply to every response from that site. Also clear any CDN or page cache, and check you edited the config that actually serves your domain.

Does Cross-Origin-Resource-Policy affect SEO or performance?

No measurable performance cost — it's a few bytes per response. It doesn't affect rankings directly, but a misconfigured policy can break page resources, so test before enforcing.

Which compliance frameworks reference Cross-Origin-Resource-Policy?

OWASP ASVS V14.4.