# COEP (/en/docs/platform/monitoring/coep)





`Cross-Origin-Embedder-Policy` requires every cross-origin resource to opt in to being embedded. This lists the ones that did not.

It is half of cross-origin isolation, the prerequisite for `SharedArrayBuffer` and high-resolution timers.

Blocked resources are grouped by the origin that was refused:

<img alt="Resources blocked by COEP, grouped by the origin that was refused" src="__img0" width="1359" height="412" />

## Columns [#columns]

The report table has these columns:

| Column              | What it means                                                |
| ------------------- | ------------------------------------------------------------ |
| **Kind**            | The kind of COEP failure                                     |
| **Blocked origin**  | Where the resource came from                                 |
| **Document origin** | The page that tried to load it                               |
| **Browsers**        | Browsers that reported it                                    |
| **Disposition**     | Enforced means blocked, Report-only means it would have been |
| **Reports**         | Reports collapsed into this row                              |
| **Last seen**       | Most recent occurrence                                       |

## Where the fix belongs [#where-the-fix-belongs]

The resource must send `Cross-Origin-Resource-Policy`, or be fetched with CORS:

```http
Cross-Origin-Resource-Policy: cross-origin
```

For a resource you control, add the header. For a third party you are waiting on them to ship it, and the real options are hosting a copy yourself, dropping the dependency, or postponing isolation.

## Try credentialless before giving up [#try-credentialless-before-giving-up]

The generated starting point is the strict mode:

```http
Cross-Origin-Embedder-Policy-Report-Only: require-corp; report-to="default"
```

`credentialless` is the gentler alternative. It loads cross-origin resources without credentials rather than requiring the opt-in header, which clears many entries at once:

```diff
-Cross-Origin-Embedder-Policy-Report-Only: require-corp; report-to="default"
+Cross-Origin-Embedder-Policy-Report-Only: credentialless; report-to="default"
```

The tradeoff is that anything genuinely needing cookies breaks. Check authenticated images and vendor iframes specifically.

## Sequence the rollout [#sequence-the-rollout]

Isolation only takes effect when COEP and COOP are both enforced, so a partial rollout gives you neither the capability nor the risk.

Run both in report-only, clear COEP first because it produces the longer list and depends on other people, then enforce them together. For more information, refer to [COOP](/en/docs/platform/monitoring/coop).

After the switch, the [security headers scanner](/tools/security-headers) shows which of the two a live page is actually sending and in which mode, so a half-applied rollout does not sit unnoticed.

## Next steps [#next-steps]

* [COOP](/en/docs/platform/monitoring/coop)
* [Cross-Origin-Embedder-Policy reference](/en/docs/web-security/policies/cross-origin-embedder-policy)