Your files stay on your device

Cross-Origin resource policy checker

Fetch a resource URL and see what its Cross-Origin-Resource-Policy header permits for same-origin, same-site and cross-origin embedding.

Type a resource URL and press Check CORP

The tool reads the resource's Cross-Origin-Resource-Policy header and reports what it permits for same-origin, same-site, and cross-origin embedding.

Cross-Origin-Resource-Policy is one header with one job: it tells a browser which documents may embed this resource. It matters most under COEP require-corp, where an embedder's policy demands that every subresource carry a CORP header of cross-origin or better. The check reads one response header; it does not probe the embedding side, it does not verify a certificate, and an invalid header value is reported as ignored rather than enforced.

CSP evaluator & builder

All network tools

Was this tool useful?

Cross-Origin resource policy checker

More network tools