Cross-Origin-Opener-Policy explained

Last updated November 11, 2026 · Reviewed by a CISSP-certified security practitioner

Cross-Origin-Opener-Policy: COOP puts your page in its own browsing context group so cross-origin windows can't get a handle to it. Recommended value: same-origin.

What risk does it prevent?

Cross-window attacks (XS-Leaks, tabnabbing) and Spectre-style side channels.

What is the safe recommended value?

Cross-Origin-Opener-Policy: same-origin

What are the gotchas?

OAuth or payment pop-ups that talk back via window.opener may need same-origin-allow-popups.

Which compliance controls reference it?

OWASP ASVS V14.4

How do I add it on my stack?

Check your site now

Free scan, instant grade, exact fixes for your stack.

Other security headers

Strict-Transport-Security — Forces browsers to only use HTTPS for your domain.
Content-Security-Policy — Controls which scripts, styles and frames a page may load.
X-Content-Type-Options — Stops browsers from guessing (sniffing) file types.
X-Frame-Options — Prevents your site being embedded in iframes (clickjacking).
Referrer-Policy — Limits how much of your URLs leak to other sites.
Permissions-Policy — Turns off browser features (camera, mic, geolocation) you don't use.
Cross-Origin-Resource-Policy — Stops other sites from loading your resources.
Cross-Origin-Embedder-Policy — Requires embedded resources to opt in (enables cross-origin isolation).