Build secure Content-Security-Policy (CSP 3) and a full security header suite (HSTS, X-Frame-Options, X-Content-Type-Options, Cross-Origin-Opener/Embedder/Resource-Policy, Permissions-Policy, Referrer-Policy), evaluate OWASP scores, and export Nginx, Apache, or HTML meta tags.
Cross-Origin-Embedder-Policy refuses to load any cross-origin resource that doesn't opt in itself (CORP header or CORS) — verify embeds like maps, ads or fonts still load before shipping this.
Content Security Policy (CSP) is an HTTP header that restricts resources (JS, CSS, images, frames) the browser is allowed to load for a given page, neutralizing Cross-Site Scripting (XSS) and data injection vulnerabilities.
Cross-Origin-Opener-Policy, Cross-Origin-Embedder-Policy and Cross-Origin-Resource-Policy control cross-origin isolation — COOP stops other windows from holding a reference to yours via window.opener, while COEP/CORP together gate access to SharedArrayBuffer and similar powerful APIs. COEP is the one most likely to break something: it refuses to load any cross-origin resource that doesn't explicitly opt in, so verify embeds still work before shipping it. Permissions-Policy denies browser features (camera, microphone, geolocation, payment, USB) by default so an XSS or a malicious third-party script can't silently request them. Referrer-Policy controls how much of your URL leaks to the site a link is clicked to — strict-origin-when-cross-origin is the current browser default and a safe baseline.
