Defaults.Exposed › Stats › Web security headers
How many websites use cross-origin isolation headers?
As of July 28, 2026 · census snapshot 2026-07-28
As of July 28, 2026, cross-origin isolation remains rare: 2,900,221 domains send Cross-Origin-Opener-Policy (1.05% of the 276 million graded), 1,880,489 send Cross-Origin-Embedder-Policy, and 2,449,105 send Cross-Origin-Resource-Policy.
| Result | Domains | Share |
|---|---|---|
| Cross-Origin-Opener-Policy (COOP) | 2,900,221 | 1.1% |
| Cross-Origin-Embedder-Policy (COEP) | 1,880,489 | 0.7% |
| Cross-Origin-Resource-Policy (CORP) | 2,449,105 | 0.9% |
Cite this
Statistic current as of July 28, 2026. Recomputed from the live census each edition; the number on this page and the machine-readable twin always match. Please cite Defaults.Exposed and link this page.
Defaults.Exposed, "How many websites use cross-origin isolation headers?" (as of July 28, 2026). https://defaults.exposed/stats/how-many-websites-use-cross-origin-isolation-headers
Permalink:https://defaults.exposed/stats/how-many-websites-use-cross-origin-isolation-headers · Machine-readable:cross-origin-isolation.json · Licence:open data
Methodology: how we grade the internet · Source data: defaults.exposed/data. Updated with each census edition.
Related statistics
- What percent of websites have a Content-Security-Policy?
- What percent of websites block clickjacking?
- What percent of websites set X-Content-Type-Options?
- What percent of websites set a Referrer-Policy?
- How many websites pass every security-header check?
- How many websites deploy HTTPS, HSTS and CSP together?