Skip to content
FixSecurityHeadersScan a site

How to add Cross-Origin-Resource-Policy on WordPress

Last updated · Reviewed by a CISSP-certified security practitioner

To add Cross-Origin-Resource-Policy on WordPress, set the header in functions.php (child theme) or a headers plugin with the value same-origin. Stops other sites from loading your resources. Clear page caches (plugin + CDN) and curl -I your homepage. Then confirm it with curl -I or a free FixSecurityHeaders scan.

What does Cross-Origin-Resource-Policy do?

CORP tells browsers which origins may embed your images, scripts and other resources.

Risk if missing: Other sites can embed your resources and use side channels to leak data.

What is the WordPress configuration?

Add this to functions.php (child theme) or a headers plugin:

functions.php (child theme) or a headers plugin
<?php
// Child theme functions.php (or a small mu-plugin)
add_action('send_headers', function () {
    header('Cross-Origin-Resource-Policy: same-origin');
});

How do I add it step by step?

  1. Open functions.php (child theme) or a headers plugin.
  2. Paste the Cross-Origin-Resource-Policy configuration shown below.
  3. Clear page caches (plugin + CDN) and curl -I your homepage.
  4. Run curl -I https://yourdomain.com and look for the cross-origin-resource-policy line.
  5. Scan your site on FixSecurityHeaders to confirm the grade improved.

How do I verify it worked?

terminal
curl -sI https://yourdomain.com | grep -i "cross-origin-resource-policy"
# expected:
# cross-origin-resource-policy: same-origin

Check your site now

Free scan, instant grade, exact fixes for your stack.

What are the common mistakes?

  • Public CDNs and assets meant for embedding should use cross-origin.
  • Prefer setting headers at the web server (nginx/Apache) — PHP headers don't apply to static files.
  • Page-cache plugins may serve cached responses without your headers until purged.

Quick reference

HeaderCross-Origin-Resource-Policy
Recommended valuesame-origin
StackWordPress
Wherefunctions.php (child theme) or a headers plugin
ComplianceOWASP ASVS V14.4

FAQ

What value should I use for Cross-Origin-Resource-Policy?

A safe default is same-origin. Public CDNs and assets meant for embedding should use cross-origin.

Why isn't Cross-Origin-Resource-Policy showing up on WordPress?

Prefer setting headers at the web server (nginx/Apache) — PHP headers don't apply to static files. Also clear any CDN or page cache, and check you edited the config that actually serves your domain.

Does Cross-Origin-Resource-Policy affect SEO or performance?

No measurable performance cost — it's a few bytes per response. It doesn't affect rankings directly, but a misconfigured policy can break page resources, so test before enforcing.

Which compliance frameworks reference Cross-Origin-Resource-Policy?

OWASP ASVS V14.4.

Related guides