Protect your data with site isolation

Can apply for signed-in users on any device or enrolled browsers on Windows, Mac, Linux or Android. For details, see Understand when settings apply.

Important: Make sure Managed Chrome browser is turned on for the organization.

1. In the Admin console, go to Menu  DevicesChromeSettings. The User & browser settings page opens by default.

   If you signed up for Chrome Enterprise Core, go to Menu  Chrome browserSettings.

2. To apply the setting to all users and enrolled browsers, leave the top organizational unit selected. Otherwise, select a child organizational unit.
3. Go to the Site isolation section.
4. For Windows, Mac, and Linux, click Site isolation:
   1. To require site isolation for all websites:
      1. Select Require site isolation for all websites, as well as any origins below.
      2. (Optional) Enter additional origins, separated by commas, that you want to isolate from their respective websites. For example, enter https://login.example.com to keep it isolated from the rest of https://example.com.
      3. Click Save. Or, you might click Override for an organizational unit.

         To later restore the inherited value, click Inherit. 

   2. To enable isolation for all websites but also allow users to opt out of site isolation for specific websites (default):
      1. Select Enable site isolation for all websites and any origins below, but allow users to opt out.
      2. (Optional) Enter a list of websites and origins, separated by commas, that you want to isolate.
      3. Click Save. Or, you might click Override for an organizational unit.

         To later restore the inherited value, click Inherit. 

   For Android, click Site isolation (Chrome on Android):
   1. To turn on site isolation for login websites only (default):
      1. Select Turn on site isolation only for login sites, as well as any origins below.
      2. (Optional) Enter a list of websites and origins, separated by commas, that you want to isolate.
      3. Click Save.
   2. To allow users to choose if they want to enable site isolation:
      1. Select Allow user to choose to enable site isolation.
      2. (Optional) Enter a list of websites and origins, separated by commas, that you want to isolate.
      3. Click Save. Or, you might click Override for an organizational unit.

         To later restore the inherited value, click Inherit. 

   3. To turn on site isolation for all websites:
      1. Select Turn on site isolation for all websites, as well as any origins below.
      2. (Optional) Enter a list of websites and origins, separated by commas, that you want to isolate.
      3. Click Save. Or, you might click Override for an organizational unit.

         To later restore the inherited value, click Inherit. 

Using Group Policy

In Group Policy Editor, go to Computer or User Configuration Policies Administrative Templates Google Google Chrome for both policies below.

Require site isolation for all websites

Note: Site Isolation is always enabled on Windows, and the SitePerProcess policy is only used to prevent the user from opting out.

Leaving this policy Not Configured uses the Unset behavior described above.

1. Locate and enable Enable Site Isolation for every website.
   Tip: If you don’t see this policy, download the latest policy template.

2. Deploy the update to your users.

Turn on site isolation for specific origins

Leaving this policy Not Configured uses the Unset behavior described above.

1. Test site isolation for these sites locally using the command line flag:
   - - isolate-origins=https://[*.]example.com, https://subdomain.example.org
2. Locate and enable Enable Site Isolation for specified origins.

   Tip: If you don’t see this policy, download the latest policy template.

3. Enter URLs for isolation in a comma-separated list.
   Example:https://[*.]example.com/,https://subdomain.example.org

4. Deploy the update to your users.

In your Chrome configuration profile, add or update the following keys. Then, deploy the change to your users.

<dict>
<key>SitePerProcess</key>
  <true/>
</dict>
<dict>
<key>IsolateOrigins</key>
  <string>”https://www.site1.com,https://www.site2.net”</string>
</dict>

Using your preferred JSON file editor:

1. Go to your etc/opt/chrome/policies/managed folder.
2. Create or update a JSON file and enter URLs as needed:
   • SitePerProcess—Set to true to require the policy.
   • IsolateOrigins—Add the URLs that you want to isolate.
3. Test site isolation for these sites locally using the command line flag:
   - - isolate-origins=https://[*.]example.com, https://subdomain.example.org
4. Deploy the update to your users.

This example shows how to require the SitePerProcess policy:

{
”SitePerProcess": "true”
}

This example shows how to isolate a.example.com and b.example.net:
{
“IsolateOrigins”:”https://a.example.com/,https://b.example.net/”
}

Step 4: Verify policies have been applied

After you apply any Chrome policies, users need to restart Chrome browser for the setting to take effect. You can check users’ devices to make sure the policy was applied correctly.

1. On a managed ChromeOS device, browse to chrome://policy.
2. Click Reload policies.
3. Check the Show policies with no value set box.
4. For the policies you set, make sure Status is set to OK.
5. For each policy, click Show value and make sure that the value fields are the same as what you set in the policy.

Turn off site isolation (Android only)

To turn off site isolation, disable the Android policies you set above.

After you disable the isolation policy, Chrome uses its pre-site isolation process model to render websites. Different sites might share processes with each other. And cross-site frames might be rendered in the same process as their parent page. Disabling a policy disables field trials of both policies.

Google and related marks and logos are trademarks of Google LLC. All other company and product names are trademarks of the companies with which they are associated.