COEP

Cross-Origin-Embedder-Policy requires every cross-origin resource to opt in to being embedded. This lists the ones that did not.

It is half of cross-origin isolation, the prerequisite for SharedArrayBuffer and high-resolution timers.

Blocked resources are grouped by the origin that was refused:

Columns

The report table has these columns:

Where the fix belongs

The resource must send Cross-Origin-Resource-Policy, or be fetched with CORS:

Cross-Origin-Resource-Policy: cross-origin

For a resource you control, add the header. For a third party you are waiting on them to ship it, and the real options are hosting a copy yourself, dropping the dependency, or postponing isolation.

Try credentialless before giving up

The generated starting point is the strict mode:

Cross-Origin-Embedder-Policy-Report-Only: require-corp; report-to="default"

credentialless is the gentler alternative. It loads cross-origin resources without credentials rather than requiring the opt-in header, which clears many entries at once:

-Cross-Origin-Embedder-Policy-Report-Only: require-corp; report-to="default"
+Cross-Origin-Embedder-Policy-Report-Only: credentialless; report-to="default"

The tradeoff is that anything genuinely needing cookies breaks. Check authenticated images and vendor iframes specifically.

Sequence the rollout

Isolation only takes effect when COEP and COOP are both enforced, so a partial rollout gives you neither the capability nor the risk.

Run both in report-only, clear COEP first because it produces the longer list and depends on other people, then enforce them together. For more information, refer to COOP.

After the switch, the security headers scanner shows which of the two a live page is actually sending and in which mode, so a half-applied rollout does not sit unnoticed.

Next steps

• COOP
• Cross-Origin-Embedder-Policy reference