Your files stay on your device

# Cross-Origin resource policy checker

Fetch a resource URL and see what its Cross-Origin-Resource-Policy header permits for same-origin, same-site and cross-origin embedding.

Type a resource URL and press Check CORP
The tool reads the resource's Cross-Origin-Resource-Policy header and reports what it permits for same-origin, same-site, and cross-origin embedding.

Cross-Origin-Resource-Policy is one header with one job: it tells a browser which documents may embed this resource. It matters most under COEP require-corp, where an embedder's policy demands that every subresource carry a CORP header of cross-origin or better. The check reads one response header; it does not probe the embedding side, it does not verify a certificate, and an invalid header value is reported as ignored rather than enforced.
Options

## More network tools

- [CSP evaluator & builder](/web/csp)
[All network tools](/network)

Was this tool useful?
YesNo

---

Canonical HTML: https://nutter.tools/network/cross-origin-resource-policy-checker
Markdown version: https://nutter.tools/network/cross-origin-resource-policy-checker.md
Plain-text version: https://nutter.tools/network/cross-origin-resource-policy-checker.txt
Agent index: https://nutter.tools/llms.txt