No Cross-Origin-Opener-Policy is set
What this check looks for
Windows your site opens, and windows that open your site, can still reach into each other. Setting this separates them.
Why it matters
Nothing is wrong. It is recorded because Cross-Origin-Opener-Policy: same-origin is a small change that removes a class of cross-window attacks, and because it is half of what a page needs to use the high-precision timers modern APIs require.
When the check passes, your report says: “A Cross-Origin-Opener-Policy isolates this page's window”.
What it costs your score
This check never deducts. It reports a fact — or reports that something could not be verified — and is shown on the report without moving the score.
- Severity
- info
- Default confidence
- confirmed
- Status when triggered
- info
- Deduction
- 0 points
- Family cap
- none
- Category
- Web security
- Module
- Web security headers
- Fix owned by
- user
- In the ruleset since
- 2026.09
Technical detail
‹value›
same-origin severs the window.opener relationship with cross-origin documents. It is a prerequisite, with Cross-Origin-Embedder-Policy, for cross-origin isolation and therefore for SharedArrayBuffer and performance.measureUserAgentSpecificMemory(). Check any OAuth or payment popup flow before enabling it — those rely on window.opener.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.
Other web security headers checks
- No Cross-Origin-Embedder-Policy is set
- No Cross-Origin-Resource-Policy is set
- No Content Security Policy is enforced
- The policy leaves plugins or the base URL unrestricted
- The Content Security Policy is report-only
- The policy allows eval()
- The policy allows inline scripts or styles
- The policy allows resources from anywhere
- A security header was sent twice with different values
- HSTS max-age is shorter than six months
- HTTP Strict Transport Security is not in force
- HSTS does not cover subdomains