How to add the Cross-Origin-Resource-Policy header in Netlify

CORP lets you say which origins may load your resources, such as images and scripts.

Netlify configuration (_headers file)

/*
  Cross-Origin-Resource-Policy: same-origin

Put the _headers file in your publish directory, or use a [[headers]] block in netlify.toml, then redeploy.

Use same-site or cross-origin for assets that other sites or your CDN subdomains legitimately load.

curl -sI https://your-site.com | grep -i cross-origin-resource-policy

Or run a free Korrali Web scan to check this and every other security header at once.