wpseek.com
A WordPress-centric search engine for devs and theme authors

function wp_set_up_cross_origin_isolation(): void {
	if ( ! wp_is_client_side_media_processing_enabled() ) {
		return;
	}

	$screen = get_current_screen();

	if ( ! $screen ) {
		return;
	}

	if ( ! $screen->is_block_editor() && 'site-editor' !== $screen->id && ! ( 'widgets' === $screen->id && wp_use_widgets_block_editor() ) ) {
		return;
	}

	/*
	 * Skip when rendering the classic-theme home route, which shows the site
	 * preview in an iframe and must reach its `contentDocument` to neutralize
	 * interactive elements. DIP would block that same-origin access.
	 *
	 * Keyed off $pagenow rather than the current screen so the guard keeps
	 * working if the header set-up is ever moved to an earlier hook (such as
	 * admin_init) where the screen is not yet available.
	 */
	global $pagenow;

	// phpcs:ignore WordPress.Security.NonceVerification.Recommended
	if ( 'site-editor.php' === $pagenow && ! wp_is_block_theme() && ( ! isset( $_GET['p'] ) || '/' === $_GET['p'] ) ) {
		return;
	}

	/*
	 * Skip when a third-party page builder overrides the block editor.
	 * DIP isolates the document into its own agent cluster,
	 * which blocks same-origin iframe access that these editors rely on.
	 */
	if ( isset( $_GET['action'] ) && 'edit' !== $_GET['action'] ) {
		return;
	}

	// Cross-origin isolation is not needed if users can't upload files anyway.
	if ( ! current_user_can( 'upload_files' ) ) {
		return;
	}

	wp_start_cross_origin_isolation_output_buffer();
}