# Cross-Origin Opener Policy and Related Isolation Headers

> Sends Cross-Origin-Opener-Policy, Origin-Agent-Cluster and X-Permitted-Cross-Domain-Policies headers on public pages, which stop other sites you link to or that open yours from reaching into your pages.

- Type: PHP
- Runs: Frontend only
- Category: [Security](https://wpide.com/library/category/security/)
- Tags: headers, coop, isolation
- Author: WPIDE Team
- Installs: 0
- Updated: 2026-10-28
- Page: https://wpide.com/library/sec-cross-origin-isolation-headers/

## Code

```php
// 'same-origin-allow-popups' is safe for most sites; 'same-origin' is stricter.
$wpide_coop = 'same-origin-allow-popups';

add_action( 'send_headers', function () use ( $wpide_coop ) {
    if ( headers_sent() ) {
        return;
    }

    header( 'Cross-Origin-Opener-Policy: ' . $wpide_coop );
    header( 'Origin-Agent-Cluster: ?1' );
    header( 'X-Permitted-Cross-Domain-Policies: none' );
} );
```

## Notes

same-origin-allow-popups keeps payment and social login popups working; switch to same-origin only if you use none.

## How to use it

Install the free WPIDE plugin (https://wordpress.org/plugins/wpide/), find "Cross-Origin Opener Policy and Related Isolation Headers" in its snippet library and add it in one click; or create a new PHP snippet in WPIDE (or any code snippets plugin) and paste the code above. More snippets: https://wpide.com/library/