---
title: "Keep other sites' windows apart · Agent Wranglers"
url: https://agentwranglers.se/playbook/website/security/cross-origin-isolation
updated: 2026-10-20
licence: "All rights reserved"
---

# Keep other sites' windows apart

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Recommended
- Chapter: [Security](https://agentwranglers.se/playbook/website/security)
- Rule: Send `Cross-Origin-Opener-Policy: same-origin` and a `Cross-Origin-Resource-Policy`. These keep other sites' windows and pages away from yours. Add COEP only if you need full isolation.
- How: Send `Cross-Origin-Opener-Policy: same-origin` and `Cross-Origin-Resource-Policy: same-site`. Use `same-origin-allow-popups` on pages that open sign-in or payment popups. Use `cross-origin` on files meant to be embedded elsewhere. Add `Cross-Origin-Embedder-Policy: require-corp` or `credentialless` only if you need cross-origin isolation, for example for `SharedArrayBuffer`.
- Check: `curl -sI` shows both headers on pages and files. Every page still loads its embeds, sign-in popups and payment popups in a browser test.

Example:

```http
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-site
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers website playbook: https://agentwranglers.se/playbook/website/security/cross-origin-isolation`.

- Previous: [Refuse odd requests from other sites](https://agentwranglers.se/playbook/website/security/fetch-metadata)
- Next: [Share less in the Referer header](https://agentwranglers.se/playbook/website/security/referrer-policy)
- [Security](https://agentwranglers.se/playbook/website/security)