Free Tool

Free Cross-Origin-Embedder-Policy (COEP) Checker

Check whether a website sets Cross-Origin-Embedder-Policy, which is required for cross origin isolation and powerful browser features.

Free and instant. No account or signup needed.

What the Cross-Origin-Embedder-Policy header does

Cross-Origin-Embedder-Policy, or COEP, is a response header that controls how a page is allowed to load cross origin resources such as images, scripts, fonts, and iframes. By default a browser will happily pull in resources from anywhere. COEP flips that and tells the browser to only embed cross origin content that has explicitly agreed to be loaded. That stricter rule is the price of admission for cross origin isolation, a state that unlocks features browsers otherwise keep locked away.

The header takes two meaningful values. With require-corp, every cross origin resource has to opt in by sending a Cross-Origin-Resource-Policy header or by going through a full CORS check, so anything that stays silent simply fails to load. With credentialless, the browser instead fetches cross origin resources without cookies or other credentials, which means those resources no longer need to opt in at all. The credentialless value is often the gentler path when you cannot control every third party resource your page embeds.

Why isolation matters for SharedArrayBuffer and timers

After the Spectre class of CPU attacks, browsers pulled back access to SharedArrayBuffer and to high precision timers because they could be abused to read memory across origins. Those capabilities now return only when a page is cross origin isolated, and isolation requires COEP working together with a Cross-Origin-Opener-Policy of same-origin. Set just one and you get nothing, so both pieces have to be in place. Once they are, your page can use shared memory, precise timing, and certain measurement APIs that modern apps and games rely on. If you are building anything that needs those features, start by sending Cross-Origin-Embedder-Policy and confirming your embedded resources are ready to opt in. The free cross origin isolation checker confirms whether COEP and COOP line up the way they need to.

Frequently asked questions

What is a COEP checker?

A COEP checker inspects the Cross-Origin-Embedder-Policy header a website returns and tells you whether the page requires embedded cross origin resources to opt in. SiteSecurityScore checks this live by scanning the URL you enter.

What is the difference between require-corp and credentialless?

With require-corp, every cross origin resource must explicitly grant permission through a CORP header or CORS. With credentialless, the browser instead loads cross origin resources without credentials such as cookies, so they do not need an explicit opt in. Both values enable cross origin isolation when paired with the right COOP header.

Why does SharedArrayBuffer need COEP?

SharedArrayBuffer and high resolution timers were restricted after Spectre style attacks. Browsers only re enable them when a page is cross origin isolated, which requires both Cross-Origin-Embedder-Policy and Cross-Origin-Opener-Policy to be set correctly.

How do I fix a missing COEP header?

Send Cross-Origin-Embedder-Policy: require-corp from your server, then make sure every embedded cross origin resource responds with a matching CORP or CORS header. If updating those resources is hard, credentialless can be an easier path. Pair this with Cross-Origin-Opener-Policy: same-origin to reach full isolation.

Does this checker scan a live site?

Yes. Enter a URL and SiteSecurityScore fetches the live response, reads the Cross-Origin-Embedder-Policy header, and reports what it found in seconds. No account or signup is required.

Check every layer in one scan

This checker covers one piece. Run a full SiteSecurityScore scan for your security headers, CSP, TLS, DNS, and cookies with a letter grade and copy and paste fixes. No account required.

Run a full scan