Cross-Origin-Embedder-Policy explained

Last updated November 11, 2026 · Reviewed by a CISSP-certified security practitioner

Cross-Origin-Embedder-Policy: COEP makes the page refuse cross-origin resources that haven't opted in via CORP or CORS. Combined with COOP it enables cross-origin isolation. Recommended value: require-corp.

What risk does it prevent?

Informational: mainly needed for SharedArrayBuffer and high-precision timers.

What is the safe recommended value?

Cross-Origin-Embedder-Policy: require-corp

What are the gotchas?

Easily breaks third‑party images, fonts and embeds. Consider credentialless, and only deploy if you need isolation.

Which compliance controls reference it?

OWASP ASVS V14.4

How do I add it on my stack?

Check your site now

Free scan, instant grade, exact fixes for your stack.

Other security headers

Strict-Transport-Security — Forces browsers to only use HTTPS for your domain.
Content-Security-Policy — Controls which scripts, styles and frames a page may load.
X-Content-Type-Options — Stops browsers from guessing (sniffing) file types.
X-Frame-Options — Prevents your site being embedded in iframes (clickjacking).
Referrer-Policy — Limits how much of your URLs leak to other sites.
Permissions-Policy — Turns off browser features (camera, mic, geolocation) you don't use.
Cross-Origin-Opener-Policy — Isolates your window from pop-ups and openers on other sites.
Cross-Origin-Resource-Policy — Stops other sites from loading your resources.