Title: wp_set_up_cross_origin_isolation
Published: August 20, 2026

---

# wp_set_up_cross_origin_isolation()

## In this article

 * [Description](https://developer.wordpress.org/reference/functions/wp_set_up_cross_origin_isolation/?output_format=md#description)
 * [Source](https://developer.wordpress.org/reference/functions/wp_set_up_cross_origin_isolation/?output_format=md#source)
 * [Related](https://developer.wordpress.org/reference/functions/wp_set_up_cross_origin_isolation/?output_format=md#related)
 * [Changelog](https://developer.wordpress.org/reference/functions/wp_set_up_cross_origin_isolation/?output_format=md#changelog)

[ Back to top](https://developer.wordpress.org/reference/functions/wp_set_up_cross_origin_isolation/?output_format=md#wp--skip-link--target)

Enables cross-origin isolation in the block editor.

## 󠀁[Description](https://developer.wordpress.org/reference/functions/wp_set_up_cross_origin_isolation/?output_format=md#description)󠁿

Required for enabling SharedArrayBuffer for WebAssembly-based media processing in
the editor. Uses Document-Isolation-Policy on supported browsers (Chromium 137+).

Skips setup when a third-party page builder overrides the block editor via a custom`
action` query parameter, as DIP would block same-origin iframe access that these
editors rely on.

## 󠀁[Source](https://developer.wordpress.org/reference/functions/wp_set_up_cross_origin_isolation/?output_format=md#source)󠁿

    ```php
    function wp_set_up_cross_origin_isolation(): void {
    	if ( ! wp_is_client_side_media_processing_enabled() ) {
    		return;
    	}

    	$screen = get_current_screen();

    	if ( ! $screen ) {
    		return;
    	}

    	if ( ! $screen->is_block_editor() && 'site-editor' !== $screen->id && ! ( 'widgets' === $screen->id && wp_use_widgets_block_editor() ) ) {
    		return;
    	}

    	/*
    	 * Skip when rendering the classic-theme home route, which shows the site
    	 * preview in an iframe and must reach its `contentDocument` to neutralize
    	 * interactive elements. DIP would block that same-origin access.
    	 *
    	 * Keyed off $pagenow rather than the current screen so the guard keeps
    	 * working if the header set-up is ever moved to an earlier hook (such as
    	 * admin_init) where the screen is not yet available.
    	 */
    	global $pagenow;

    	// phpcs:ignore WordPress.Security.NonceVerification.Recommended
    	if ( 'site-editor.php' === $pagenow && ! wp_is_block_theme() && ( ! isset( $_GET['p'] ) || '/' === $_GET['p'] ) ) {
    		return;
    	}

    	/*
    	 * Skip when a third-party page builder overrides the block editor.
    	 * DIP isolates the document into its own agent cluster,
    	 * which blocks same-origin iframe access that these editors rely on.
    	 */
    	if ( isset( $_GET['action'] ) && 'edit' !== $_GET['action'] ) {
    		return;
    	}

    	// Cross-origin isolation is not needed if users can't upload files anyway.
    	if ( ! current_user_can( 'upload_files' ) ) {
    		return;
    	}

    	wp_start_cross_origin_isolation_output_buffer();
    }
    ```

[View all references](https://developer.wordpress.org/reference/files/wp-includes/media.php/)
[View on Trac](https://core.trac.wordpress.org/browser/tags/7.1/src/wp-includes/media.php#L6646)
[View on GitHub](https://github.com/WordPress/wordpress-develop/blob/7.1/src/wp-includes/media.php#L6646-L6692)

## 󠀁[Related](https://developer.wordpress.org/reference/functions/wp_set_up_cross_origin_isolation/?output_format=md#related)󠁿

| Uses | Description | 
| [wp_start_cross_origin_isolation_output_buffer()](https://developer.wordpress.org/reference/functions/wp_start_cross_origin_isolation_output_buffer/)`wp-includes/media.php` |

Sends the Document-Isolation-Policy header for cross-origin isolation.

  | 
| [wp_is_client_side_media_processing_enabled()](https://developer.wordpress.org/reference/functions/wp_is_client_side_media_processing_enabled/)`wp-includes/media.php` |

Checks whether client-side media processing is enabled.

  | 
| [wp_is_block_theme()](https://developer.wordpress.org/reference/functions/wp_is_block_theme/)`wp-includes/theme.php` |

Returns whether the active theme is a block-based theme or not.

  | 
| [wp_use_widgets_block_editor()](https://developer.wordpress.org/reference/functions/wp_use_widgets_block_editor/)`wp-includes/widgets.php` |

Determines whether or not to use the block editor to manage widgets.

  | 
| [get_current_screen()](https://developer.wordpress.org/reference/functions/get_current_screen/)`wp-admin/includes/screen.php` |

Get the current screen object

  | 
| [current_user_can()](https://developer.wordpress.org/reference/functions/current_user_can/)`wp-includes/capabilities.php` |

Returns whether the current user has the specified capability.

  |

[Show 1 more](https://developer.wordpress.org/reference/functions/wp_set_up_cross_origin_isolation/?output_format=md#)
[Show less](https://developer.wordpress.org/reference/functions/wp_set_up_cross_origin_isolation/?output_format=md#)

## 󠀁[Changelog](https://developer.wordpress.org/reference/functions/wp_set_up_cross_origin_isolation/?output_format=md#changelog)󠁿

| Version | Description | 
| [7.1.0](https://developer.wordpress.org/reference/since/7.1.0/) | Introduced. |

## User Contributed Notes

You must [log in](https://login.wordpress.org/?redirect_to=https%3A%2F%2Fdeveloper.wordpress.org%2Freference%2Ffunctions%2Fwp_set_up_cross_origin_isolation%2F)
before being able to contribute a note or feedback.