Cross-Origin Isolation Analyzer
Paste HTTP response headers to review Cross-Origin-Opener-Policy, Cross-Origin-Embedder-Policy, Cross-Origin-Resource-Policy, and an explicit Permissions-Policy cross-origin-isolated blocker. The tool checks whether the pasted header pattern matches documented cross-origin isolation prerequisites without claiming that a live page is actually isolated.
Review pasted HTTP response headers for the COOP and COEP patterns associated with cross-origin isolation, while also showing CORP and a relevant Permissions-Policy blocking condition.
How to review cross-origin isolation headers
- Paste the relevant response headers or a full HTTP response header block.
- Review COOP, COEP, CORP, and Permissions-Policy findings.
- Use the compatible, incomplete, or invalid state as a header-pattern check rather than a live page verdict.
What the analyzer checks
COOP is considered isolation-compatible when its valid effective value is same-origin; COEP is compatible with require-corp or credentialless.
Repeated or invalid policy headers are errors, missing COOP or COEP is a review item, and cross-origin-isolated=() in Permissions-Policy is treated as blocking.
Privacy and limitations
Pasted header text is processed locally. The tool does not load the page, inspect subresources, test opener relationships, or confirm that window.crossOriginIsolated is actually true in a browser.
Cross-Origin Isolation Analyzer FAQ
Does it check a live page?
No. It only analyzes pasted headers.
Which COOP value is treated as compatible?
same-origin.
Which COEP values are treated as compatible?
require-corp and credentialless.
Does CORP alone make a page cross-origin isolated?
No. CORP is displayed, but the compatibility result depends on the implemented COOP, COEP, and blocking checks.
Are the headers sent anywhere?
No. Processing is browser-local.