Skip to content

Headers

Cross-origin headers

Every planAbout Security Headers

Keeps your pages and files separate from other websites: other sites cannot reach into a window your site opened, or load your files where you did not intend.

What it does

Block cross-domain policy files tells old Adobe products not to read data from your site. There is no reason to allow it today.

Cross-Origin-Opener-Policy puts your pages in their own browser window group, so a page from another site that opened yours, or that yours opened, cannot control it.

Cross-Origin-Resource-Policy decides which sites may load your images, scripts and other files.

Why it matters

These headers defend against a newer group of attacks that read information across browser tabs. They are quick wins for most sites and are scored by modern security scanners.

Set it up

  1. Make sure HTTP Security Headers in Core headers is on.
  2. In section Cross-origin headers, switch on Block cross-domain policy files.
  3. Set Cross-Origin-Opener-Policy to same-origin-allow-popups. Choose the stricter same-origin only if your site has no sign-in or payment popups from other services.
  4. Set Cross-Origin-Resource-Policy to same-site. Choose cross-origin if other websites must show your images or files.
  5. Click Save Changes and test sign-in, checkout and any embeds.

Good to know

Payment and social sign-in popups (for example PayPal or Google) can break with Cross-Origin-Opener-Policy set to same-origin.

Cross-Origin-Embedder-Policy is on the roadmap. It is marked "Can break embeds" because it blocks most third-party videos and widgets.

Which plan includes it

Blocking cross-domain policy files is in every plan. Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy are part of Pro.

How it works, for developers
  • Headers sent: X-Permitted-Cross-Domain-Policies: none, Cross-Origin-Opener-Policy (same-origin-allow-popups or same-origin) and Cross-Origin-Resource-Policy (same-site, same-origin or cross-origin). Each is off until chosen.
  • Sent on send_headers with the core headers, so only for front-end pages and only while smg_security_headers is on.
  • Settings: smg_cross_domain_policy, smg_coop_policy, smg_corp_policy.

Quick answers about cross-origin headers

What does Cross-origin headers do in Stack Guard?

Block cross-domain policy files tells old Adobe products not to read data from your site. There is no reason to allow it today. Cross-Origin-Opener-Policy puts your pages in their own browser window group, so a page from another site that opened yours, or that yours opened, cannot control it. Cross-Origin-Resource-Policy decides which sites may load your images, scripts and other files.

Why use cross-origin headers on a WordPress site?

These headers defend against a newer group of attacks that read information across browser tabs. They are quick wins for most sites and are scored by modern security scanners.

How do I set up cross-origin headers?

1. Make sure HTTP Security Headers in Core headers is on. 2. In section Cross-origin headers, switch on Block cross-domain policy files. 3. Set Cross-Origin-Opener-Policy to same-origin-allow-popups. Choose the stricter same-origin only if your site has no sign-in or payment popups from other services. 4. Set Cross-Origin-Resource-Policy to same-site. Choose cross-origin if other websites must show your images or files. 5. Click Save Changes and test sign-in, checkout and any embeds.

Which Stack Guard plan includes cross-origin headers?

Blocking cross-domain policy files is in every plan. Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy are part of Pro.

More in Headers

Not running Stack Guard yet? It is free.

Download Free