Cross-Origin Opener Policy and Related Isolation Headers
Sends Cross-Origin-Opener-Policy, Origin-Agent-Cluster and X-Permitted-Cross-Domain-Policies headers on public pages, which stop other sites you link to or that open yours from reaching into your pages.
Opens WPIDE on
Code
// 'same-origin-allow-popups' is safe for most sites; 'same-origin' is stricter.
$wpide_coop = 'same-origin-allow-popups';
add_action( 'send_headers', function () use ( $wpide_coop ) {
if ( headers_sent() ) {
return;
}
header( 'Cross-Origin-Opener-Policy: ' . $wpide_coop );
header( 'Origin-Agent-Cluster: ?1' );
header( 'X-Permitted-Cross-Domain-Policies: none' );
} );Notes
same-origin-allow-popups keeps payment and social login popups working; switch to same-origin only if you use none.
How to add this snippet
- Install WPIDE on your WordPress site (it is free) and open Code Snippets.
- Use snippet above adds it from the library in one click. Or copy the code into a new snippet with the same code type.
- It is added inactive: review the code and settings, then switch it on.