Security Headers

Cross-origin policy check

Two headers that isolate your pages from other sites a visitor has open, closing off cross-site data leaks.

Check this on your own domain now. It is free with a DomainGuard account and works on any domain. The check reads only what your domain publishes, and gives you a report you can send to whoever runs your website.

Run the Security Headers CheckerRun every check

What we look at

We read the Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy headers.

Why it matters to your business

They stop another site in the same browser from reaching into your page's window or pulling in your resources, which blocks a family of side-channel attacks. Lower priority than CSP and HSTS, and cheap to add.

How to fix it

  1. Send Cross-Origin-Opener-Policy: same-origin (or same-origin-allow-popups if you use sign-in popups).
  2. Send Cross-Origin-Resource-Policy: same-site.

If you would rather not touch DNS or server settings yourself, forward this page and your report to whoever manages your website, or ask us to do it.

Check your own site for this

A free outside-in check of your website, email and domain records, with what to fix first. No card and no password to choose.

Free, no card, no password to choose: your name and email make a free DomainGuard account that keeps the report, and we email you a link to confirm it. We only read what the internet can already see.