Cross-Origin Isolation Checker
Check COOP, COEP and related response headers for cross-origin isolation readiness.
Checks the response headers returned by a public HTTP/HTTPS page. Private, local and unsafe network targets are blocked.
Check whether a page is ready for cross-origin isolation
This tool inspects the response headers of a public webpage and checks the settings commonly required for cross-origin isolation. It focuses on Cross-Origin-Opener-Policy (COOP), Cross-Origin-Embedder-Policy (COEP), HTTPS and any Permissions-Policy rule that explicitly blocks cross-origin-isolated.
How to use it
- Enter a public HTTP or HTTPS page URL.
- Select Check isolation headers.
- Review the final URL, HTTP status and header findings.
What a ready result means
A ready result means the checker found Cross-Origin-Opener-Policy: same-origin, a compatible COEP value such as require-corp or credentialless, no explicit Permissions-Policy block, and an HTTPS final URL with a successful response.
What this checker does not prove
Headers are only part of the picture. Embedded scripts, images, workers or other cross-origin resources can still affect whether an application works correctly after isolation is enabled. Use the result as a focused configuration check, not as a complete application test.
Why this matters
Cross-origin isolation is relevant to browser features that need stronger separation between browsing contexts, including some high-performance web and WebAssembly workloads.