Cross-Origin Policy Bundle Generator

Pick COOP, COEP and CORP values and generate a matching set of response headers.

Runs in your browser. Nothing is uploaded — your input is processed on this device and discarded when you close the tab.

Cross-Origin-Opener-Policy

Cross-Origin-Embedder-Policy

Cross-Origin-Resource-Policy

How to use this tool

Enter your values in the fields above.
Press Generate to see the result.
Use Load sample to try the worked example, Copy result to copy it, or Clear to start again.

Choosing same-origin, require-corp and same-origin generates those three headers as one bundle.

This tool only generates header text. It does not apply headers to any site, and it does not verify that a server sends them.

Is this bundle safe to paste into production?

Test it on staging first. Isolation headers can break cross-origin embeds, so verify your pages still work.

Does this tool apply the headers to my site?

No. It only generates the header text for you to configure on your own server.

Format, validate, minify, query and compare JSON in your browser, with precise line-and-column errors.

Live

Test patterns against sample text with match highlighting, capture groups and a safe one-second timeout.

Live

Check HSTS, CSP and other security headers, TLS details, and DNS/email authentication records (SPF, DKIM, DMARC).

Live