diff --git a/files/en-us/web/http/reference/headers/cross-origin-embedder-policy/index.md b/files/en-us/web/http/reference/headers/cross-origin-embedder-policy/index.md index 07834c2e3b92a6d..e0e28c8afaf05b9 100644 --- a/files/en-us/web/http/reference/headers/cross-origin-embedder-policy/index.md +++ b/files/en-us/web/http/reference/headers/cross-origin-embedder-policy/index.md @@ -10,7 +10,7 @@ sidebar: http The HTTP **`Cross-Origin-Embedder-Policy`** (COEP) {{Glossary("response header")}} configures the current document's policy for loading and embedding cross-origin resources. The policy for whether a particular resource is embeddable cross-site may be defined for that resource using the {{HTTPHeader("Cross-Origin-Resource-Policy")}} (CORP) header for a `no-cors` fetch, or using [CORS](/en-US/docs/Web/HTTP/Guides/CORS). -If neither of these policies are set, then by default, resources can be loaded or embedded into a document as though they had a CORP value of `cross-site`. +If neither of these policies are set, then by default, resources can be loaded or embedded into a document as though they had a CORP value of `cross-origin`. The **`Cross-Origin-Embedder-Policy`** allows you to require that CORP or CORS headers be set in order to load cross-site resources into the current document. You can also set the policy to keep the default behavior, or to allow the resources to be loaded, but strip any credentials that might otherwise be sent.