How to add the Cross-Origin-Resource-Policy header in Apache

CORP lets you say which origins may load your resources, such as images and scripts.

Apache configuration (.htaccess or virtual host)

<IfModule mod_headers.c>
  Header always set Cross-Origin-Resource-Policy "same-origin"
</IfModule>

Requires mod_headers (a2enmod headers on Debian/Ubuntu). Reload Apache after editing the virtual host.

Use same-site or cross-origin for assets that other sites or your CDN subdomains legitimately load.

curl -sI https://your-site.com | grep -i cross-origin-resource-policy

Or run a free Korrali Web scan to check this and every other security header at once.