KKorrali Web

Security headers › Cross-Origin-Opener-Policy

How to add the Cross-Origin-Opener-Policy header in Cloudflare

COOP isolates your page's browsing context from cross-origin windows it opens or that open it.

Cloudflare configuration (Transform Rules)

Rules > Transform Rules > Modify Response Header
Action: Set static
Header name: Cross-Origin-Opener-Policy
Value: same-origin

Create the rule for your hostname in the Cloudflare dashboard. For HSTS, Cloudflare also has a dedicated setting under SSL/TLS > Edge Certificates. On Cloudflare Pages you can use a _headers file instead.

Before you deploy

same-origin can break OAuth or payment pop-ups that rely on window.opener. Use same-origin-allow-popups in that case.

Verify it works

curl -sI https://your-site.com | grep -i cross-origin-opener-policy

Or run a free Korrali Web scan to check this and every other security header at once.

Scan your site free

Other headers in Cloudflare