How to add the Cross-Origin-Opener-Policy header in Apache

COOP isolates your page's browsing context from cross-origin windows it opens or that open it.

Apache configuration (.htaccess or virtual host)

<IfModule mod_headers.c>
  Header always set Cross-Origin-Opener-Policy "same-origin"
</IfModule>

Requires mod_headers (a2enmod headers on Debian/Ubuntu). Reload Apache after editing the virtual host.

same-origin can break OAuth or payment pop-ups that rely on window.opener. Use same-origin-allow-popups in that case.

curl -sI https://your-site.com | grep -i cross-origin-opener-policy

Or run a free Korrali Web scan to check this and every other security header at once.