Cross-Origin-Resource-Policy explained

Last updated November 11, 2026 · Reviewed by a CISSP-certified security practitioner

Cross-Origin-Resource-Policy: CORP tells browsers which origins may embed your images, scripts and other resources. Recommended value: same-origin.

What risk does it prevent?

Other sites can embed your resources and use side channels to leak data.

What is the safe recommended value?

Cross-Origin-Resource-Policy: same-origin

What are the gotchas?

Public CDNs and assets meant for embedding should use cross-origin.

Which compliance controls reference it?

OWASP ASVS V14.4

How do I add it on my stack?

Check your site now

Free scan, instant grade, exact fixes for your stack.

Other security headers

Strict-Transport-Security — Forces browsers to only use HTTPS for your domain.
Content-Security-Policy — Controls which scripts, styles and frames a page may load.
X-Content-Type-Options — Stops browsers from guessing (sniffing) file types.
X-Frame-Options — Prevents your site being embedded in iframes (clickjacking).
Referrer-Policy — Limits how much of your URLs leak to other sites.
Permissions-Policy — Turns off browser features (camera, mic, geolocation) you don't use.
Cross-Origin-Opener-Policy — Isolates your window from pop-ups and openers on other sites.
Cross-Origin-Embedder-Policy — Requires embedded resources to opt in (enables cross-origin isolation).