Title: wp_start_cross_origin_isolation_output_buffer
Published: August 20, 2026

---

# wp_start_cross_origin_isolation_output_buffer()

## In this article

 * [Description](https://developer.wordpress.org/reference/functions/wp_start_cross_origin_isolation_output_buffer/?output_format=md#description)
 * [Source](https://developer.wordpress.org/reference/functions/wp_start_cross_origin_isolation_output_buffer/?output_format=md#source)
 * [Related](https://developer.wordpress.org/reference/functions/wp_start_cross_origin_isolation_output_buffer/?output_format=md#related)
 * [Changelog](https://developer.wordpress.org/reference/functions/wp_start_cross_origin_isolation_output_buffer/?output_format=md#changelog)

[ Back to top](https://developer.wordpress.org/reference/functions/wp_start_cross_origin_isolation_output_buffer/?output_format=md#wp--skip-link--target)

Sends the Document-Isolation-Policy header for cross-origin isolation.

## 󠀁[Description](https://developer.wordpress.org/reference/functions/wp_start_cross_origin_isolation_output_buffer/?output_format=md#description)󠁿

Uses an output buffer to add crossorigin=”anonymous” where needed.

## 󠀁[Source](https://developer.wordpress.org/reference/functions/wp_start_cross_origin_isolation_output_buffer/?output_format=md#source)󠁿

    ```php
    function wp_start_cross_origin_isolation_output_buffer(): void {
    	$chromium_version = wp_get_chromium_major_version();

    	if ( null === $chromium_version || $chromium_version < 137 ) {
    		return;
    	}

    	ob_start(
    		static function ( string $output ): string {
    			header( 'Document-Isolation-Policy: isolate-and-credentialless' );

    			return wp_add_crossorigin_attributes( $output );
    		}
    	);
    }
    ```

[View all references](https://developer.wordpress.org/reference/files/wp-includes/media.php/)
[View on Trac](https://core.trac.wordpress.org/browser/tags/7.1/src/wp-includes/media.php#L6701)
[View on GitHub](https://github.com/WordPress/wordpress-develop/blob/7.1/src/wp-includes/media.php#L6701-L6715)

## 󠀁[Related](https://developer.wordpress.org/reference/functions/wp_start_cross_origin_isolation_output_buffer/?output_format=md#related)󠁿

| Uses | Description | 
| [wp_add_crossorigin_attributes()](https://developer.wordpress.org/reference/functions/wp_add_crossorigin_attributes/)`wp-includes/media.php` |

Adds crossorigin=”anonymous” to relevant tags in the given HTML string.

  | 
| [wp_get_chromium_major_version()](https://developer.wordpress.org/reference/functions/wp_get_chromium_major_version/)`wp-includes/media.php` |

Returns the major Chrome/Chromium version from the current request’s User-Agent.

  |

| Used by | Description | 
| [wp_set_up_cross_origin_isolation()](https://developer.wordpress.org/reference/functions/wp_set_up_cross_origin_isolation/)`wp-includes/media.php` |

Enables cross-origin isolation in the block editor.

  |

## 󠀁[Changelog](https://developer.wordpress.org/reference/functions/wp_start_cross_origin_isolation_output_buffer/?output_format=md#changelog)󠁿

| Version | Description | 
| [7.1.0](https://developer.wordpress.org/reference/since/7.1.0/) | Introduced. |

## User Contributed Notes

You must [log in](https://login.wordpress.org/?redirect_to=https%3A%2F%2Fdeveloper.wordpress.org%2Freference%2Ffunctions%2Fwp_start_cross_origin_isolation_output_buffer%2F)
before being able to contribute a note or feedback.