Cross-Origin-Embedder-Policy
Requires any cross-origin resource your page embeds to explicitly opt in, a building block for powerful browser isolation.
What it does
Cross-Origin-Embedder-Policy (COEP), set to require-corp, tells the browser to block any cross-origin resource, image, script, iframe, that doesn't explicitly opt in via Cross-Origin-Resource-Policy or CORS headers.
Why it matters
On its own, COEP is a fairly narrow hardening measure. Its main purpose is enabling cross-origin isolation together with Cross-Origin-Opener-Policy: a state that unlocks powerful but historically risky browser APIs like SharedArrayBuffer and high-resolution timers, which browsers otherwise restrict because they've been used in speculative-execution side-channel attacks (Spectre-class).
Recommended value
If your application doesn't use SharedArrayBuffer, WebAssembly threads, or similarly gated APIs, this header is optional | Domain Flock surfaces it as informational rather than something to fix urgently. Setting it can break embedded third-party widgets (payment iframes, video players) that haven't opted in via CORP, so test thoroughly before enforcing it.