How to add the Cross-Origin-Opener-Policy header in Netlify

COOP isolates your page's browsing context from cross-origin windows it opens or that open it.

Netlify configuration (_headers file)

/*
  Cross-Origin-Opener-Policy: same-origin

Put the _headers file in your publish directory, or use a [[headers]] block in netlify.toml, then redeploy.

same-origin can break OAuth or payment pop-ups that rely on window.opener. Use same-origin-allow-popups in that case.

curl -sI https://your-site.com | grep -i cross-origin-opener-policy

Or run a free Korrali Web scan to check this and every other security header at once.