Title: wp_add_crossorigin_attributes
Published: August 20, 2026

---

# wp_add_crossorigin_attributes( string $html ): string

## In this article

 * [Parameters](https://developer.wordpress.org/reference/functions/wp_add_crossorigin_attributes/?output_format=md#parameters)
 * [Return](https://developer.wordpress.org/reference/functions/wp_add_crossorigin_attributes/?output_format=md#return)
 * [Source](https://developer.wordpress.org/reference/functions/wp_add_crossorigin_attributes/?output_format=md#source)
 * [Related](https://developer.wordpress.org/reference/functions/wp_add_crossorigin_attributes/?output_format=md#related)
 * [Changelog](https://developer.wordpress.org/reference/functions/wp_add_crossorigin_attributes/?output_format=md#changelog)

[ Back to top](https://developer.wordpress.org/reference/functions/wp_add_crossorigin_attributes/?output_format=md#wp--skip-link--target)

Adds crossorigin=”anonymous” to relevant tags in the given HTML string.

## 󠀁[Parameters](https://developer.wordpress.org/reference/functions/wp_add_crossorigin_attributes/?output_format=md#parameters)󠁿

 `$html`stringrequired

HTML input.

## 󠀁[Return](https://developer.wordpress.org/reference/functions/wp_add_crossorigin_attributes/?output_format=md#return)󠁿

 string Modified HTML.

## 󠀁[Source](https://developer.wordpress.org/reference/functions/wp_add_crossorigin_attributes/?output_format=md#source)󠁿

    ```php
    function wp_add_crossorigin_attributes( string $html ): string {
    	$site_url = site_url();

    	$processor = new WP_HTML_Tag_Processor( $html );

    	// See https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/crossorigin.
    	$cross_origin_tag_attributes = array(
    		'AUDIO'  => array( 'src' ),
    		'LINK'   => array( 'href' ),
    		'SCRIPT' => array( 'src' ),
    		'VIDEO'  => array( 'src', 'poster' ),
    		'SOURCE' => array( 'src' ),
    	);

    	while ( $processor->next_tag() ) {
    		$tag = $processor->get_tag();

    		if ( ! isset( $cross_origin_tag_attributes[ $tag ] ) ) {
    			continue;
    		}
    		$crossorigin = $processor->get_attribute( 'crossorigin' );
    		if ( null !== $crossorigin ) {
    			continue;
    		}

    		if ( 'AUDIO' === $tag || 'VIDEO' === $tag ) {
    			$processor->set_bookmark( 'audio-video-parent' );
    		}

    		$processor->set_bookmark( 'resume' );

    		$sought = false;

    		$is_cross_origin = false;

    		foreach ( $cross_origin_tag_attributes[ $tag ] as $attr ) {
    			$url = $processor->get_attribute( $attr );
    			if ( is_string( $url ) && ! str_starts_with( $url, $site_url ) && ! str_starts_with( $url, '/' ) ) {
    				$is_cross_origin = true;
    			}

    			if ( $is_cross_origin ) {
    				break;
    			}
    		}

    		if ( $is_cross_origin ) {
    			if ( 'SOURCE' === $tag ) {
    				$sought = $processor->seek( 'audio-video-parent' );

    				if ( $sought ) {
    					$processor->set_attribute( 'crossorigin', 'anonymous' );
    				}
    			} else {
    				$processor->set_attribute( 'crossorigin', 'anonymous' );
    			}

    			if ( $sought ) {
    				$processor->seek( 'resume' );
    				$processor->release_bookmark( 'audio-video-parent' );
    			}
    		}
    	}

    	return $processor->get_updated_html();
    }
    ```

[View all references](https://developer.wordpress.org/reference/files/wp-includes/media.php/)
[View on Trac](https://core.trac.wordpress.org/browser/tags/7.1/src/wp-includes/media.php#L6725)
[View on GitHub](https://github.com/WordPress/wordpress-develop/blob/7.1/src/wp-includes/media.php#L6725-L6790)

## 󠀁[Related](https://developer.wordpress.org/reference/functions/wp_add_crossorigin_attributes/?output_format=md#related)󠁿

| Uses | Description | 
| [WP_HTML_Tag_Processor::__construct()](https://developer.wordpress.org/reference/classes/wp_html_tag_processor/__construct/)`wp-includes/html-api/class-wp-html-tag-processor.php` |

Constructor.

  | 
| [site_url()](https://developer.wordpress.org/reference/functions/site_url/)`wp-includes/link-template.php` |

Retrieves the URL for the current site where WordPress application files (e.g. wp-blog-header.php or the wp-admin/ folder) are accessible.

  |

| Used by | Description | 
| [wp_start_cross_origin_isolation_output_buffer()](https://developer.wordpress.org/reference/functions/wp_start_cross_origin_isolation_output_buffer/)`wp-includes/media.php` |

Sends the Document-Isolation-Policy header for cross-origin isolation.

  |

## 󠀁[Changelog](https://developer.wordpress.org/reference/functions/wp_add_crossorigin_attributes/?output_format=md#changelog)󠁿

| Version | Description | 
| [7.1.0](https://developer.wordpress.org/reference/since/7.1.0/) | Introduced. |

## User Contributed Notes

You must [log in](https://login.wordpress.org/?redirect_to=https%3A%2F%2Fdeveloper.wordpress.org%2Freference%2Ffunctions%2Fwp_add_crossorigin_attributes%2F)
before being able to contribute a note or feedback.