No Cross-Origin-Resource-Policy is set
What this check looks for
Other sites may load this page's resources directly. For a public site that is normal; for private content it is worth restricting.
Why it matters
Nothing is wrong for a public page. It matters for anything user-specific: without this header another site can pull the resource into its own page and read side channels from it.
When the check passes, your report says: “A Cross-Origin-Resource-Policy says who may load these resources”.
What it costs your score
This check never deducts. It reports a fact — or reports that something could not be verified — and is shown on the report without moving the score.
- Severity
- info
- Default confidence
- confirmed
- Status when triggered
- info
- Deduction
- 0 points
- Family cap
- none
- Category
- Web security
- Module
- Web security headers
- Fix owned by
- user
- In the ruleset since
- 2026.09
Technical detail
‹value›
same-origin restricts a resource to your own origin; same-site allows your subdomains; cross-origin explicitly opens it up, which is what a CDN asset or a public API should say. This is the header a Cross-Origin-Embedder-Policy: require-corp page requires from every subresource it loads.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.
Other web security headers checks
- No Cross-Origin-Embedder-Policy is set
- No Cross-Origin-Opener-Policy is set
- No Content Security Policy is enforced
- The policy leaves plugins or the base URL unrestricted
- The Content Security Policy is report-only
- The policy allows eval()
- The policy allows inline scripts or styles
- The policy allows resources from anywhere
- A security header was sent twice with different values
- HSTS max-age is shorter than six months
- HTTP Strict Transport Security is not in force
- HSTS does not cover subdomains