Security
Stop other pages sharing a window with yours
Your site does not send Cross-Origin-Opener-Policy, so a page your visitor opens in a new tab can keep a live connection back into the tab that opened it.
Why it matters
When the header is absent, the new page can reach back through the browser window reference into yours. A hostile page can use that connection to replace what your visitor sees, or to probe the boundaries around your page. The header asks the browser to keep the two windows isolated, and it costs one line in the place you already send security headers.
How you would notice it
- A security scan reports a missing Cross-Origin-Opener-Policy.
- A review of third-party windows asks how your site isolates itself.
- You link out to content you do not control, from pages that show visitor data.
What to do
Stage 1
- Add the header where your other security headers live, so it travels with every page.
same-origin is the full protection. same-origin-allow-popups keeps a connection only for windows you open yourself, which some sign-in flows need.
# Cloudflare Pages or Netlify: put this in your headers file
/*
Cross-Origin-Opener-Policy: same-origin
# nginx, on a server you manage:
add_header Cross-Origin-Opener-Policy "same-origin" always;Stage 2
- Exercise every pop-up your site opens, such as a sign-in or payment flow that returns to your page, and confirm each one still finishes. This is the one place this header can break a working flow.
If a pop-up stops completing, switch the value to same-origin-allow-popups rather than removing the header. That keeps the isolation for everything except the pop-ups you chose to open.
How to check it worked
Confirm it worked
Request an ordinary page and read the response headers; confirm cross-origin-opener-policy is present with the value you chose. Then complete one pop-up flow end to end. Re-run the Siege Test and confirm the recommendation is gone.