✅ 🚀 Add support for Document-Isolation-Policy (DIP) so Elementor users can use WordPress 7.1 client-side media #35975

What problem is your feature request going to solve?

WordPress 7.1 ships client-side media processing as a core feature. Client-side media uses a wasm-vips worker to decode/encode/resize media in the browser, which requires SharedArrayBuffer, which in turn requires the page to be cross-origin isolated.

WordPress 7.0 introduced cross-origin isolation on the block editor via Cross-Origin-Embedder-Policy / Cross-Origin-Opener-Policy (COEP/COOP). Because COEP/COOP broke many third-party iframes, core switched (for 7.1) to Document-Isolation-Policy: isolate-and-credentialless (DIP), a per-document isolation mechanism in Chromium 137+ that does not require server-wide COOP/COEP configuration.

Elementor is incompatible with this isolation. When the Elementor editor loads with DIP applied to the parent document, the editor throws:

Uncaught SecurityError: Failed to read a named property 'elementorFrontend' from 'Window':
Blocked a frame with origin "https://example.com" from accessing a cross-origin frame.
    at Editor.onPreviewLoaded (editor.min.js:...)

(Reproduction reported on Elementor 3.34.4 against WordPress 7.0-beta3 by the Elementor team in this thread.)

Root cause

From the Chrome DIP documentation:

Iframes isolated with Document Isolation Policy don't have synchronous DOM access to same-origin iframes that are not isolated.

DIP places the isolated document in its own agent cluster. Elementor's editor is built on a pattern where the main editor frame (post.php?action=elementor) reaches synchronously into the same-origin preview <iframe> via iframe.contentWindow.elementorFrontend.*. With DIP applied to the editor frame but not to the preview iframe, that direct cross-frame property access is blocked by the browser's same-agent-cluster rule, even though both documents are same-origin.

Current state - workarounds, not fixes

Two workarounds are in place today, but they prevent Elementor users from getting client-side media at all:

1. WordPress core (7.1) - Skips sending DIP headers when a third-party page builder is detected via a non-edit action query parameter (WordPress/wordpress-develop#11170, part of the broader #11098 DIP work).
2. Elementor 3.35 - Registers a replace_editor filter that signals to core that Elementor is replacing the block editor, so core skips DIP on Elementor screens (elementor/elementor#34900).

Net effect: any user editing with Elementor never receives the DIP header, so crossOriginIsolated is false, so SharedArrayBuffer is unavailable, so the wasm-vips client-side media pipeline is silently disabled. Elementor users fall back to server-side media processing and miss out on:

• Client-side HEIC decoding (iPhone photos) without server libraries
• Client-side AVIF/WebP encoding
• Browser-side sub-size generation, EXIF handling, auto-rotation
• Ultra HDR (ISO 21496-1) gain-map preservation
• Resilient/retryable uploads, progress UI improvements
• Future capabilities gated on crossOriginIsolated: WebAssembly threading, WebCodecs with shared memory, high-resolution timers, real-time collaboration primitives, etc.

Describe the solution you'd like

Make Elementor compatible with Document-Isolation-Policy: isolate-and-credentialless on the editor screen so the replace_editor opt-out can eventually be removed and Elementor users get the same media (and future) capabilities as block-editor users.

Two non-exclusive approaches, each documented in the Chrome DIP guide:

Option 1 - Apply DIP to the preview iframe as well

If both the parent editor document and the preview iframe send the same DIP header, they share an agent cluster and synchronous DOM access is restored.

Sketch:

• Emit Document-Isolation-Policy: isolate-and-credentialless on the Elementor preview response (the URL loaded inside the editor preview <iframe>).
• Audit subresources in the preview (images, fonts, embedded third-party widgets, etc.). With isolate-and-credentialless, cross-origin no-CORS subresources are loaded without credentials and don't need CORP, which is much less invasive than COEP require-corp - but any iframe inside the preview that also needs DOM access will need DIP as well.
• DIP is gated on a secure context (HTTPS or localhost). Testing must be over HTTPS.

This is the lowest-effort path: it preserves Elementor's existing parent ↔ preview DOM-access pattern.

Option 2 - Replace synchronous cross-frame property access with postMessage

window.postMessage() works across DIP isolation boundaries and across origins. Refactoring the editor ↔ preview channel to message-passing makes Elementor portable across isolation modes (DIP, future origin-keyed agent clusters, cross-origin previews, etc.) and avoids the "both frames must opt in" constraint.

This is a larger refactor but is the architecturally durable answer and would also help with adjacent compatibility work (e.g. moving previews to a sandboxed/cross-origin frame in the future).

Coordination

The WordPress core media team is happy to help test, review, and co-design. Ping @adamsilverstein / @westonruter on any draft PR. Once Elementor supports DIP, the replace_editor opt-out from elementor/elementor#34900 can be removed, and the matching core workaround in WordPress/wordpress-develop#11170 can be revisited.

References

WordPress core / Gutenberg:

• Trac ticket (original report): https://core.trac.wordpress.org/ticket/64740
• Gutenberg tracking issue - Client Side Media for 7.1: Client Side Media iteration for WordPress 7.1: stabilization, docs, and Core backports WordPress/gutenberg#76756
• Client-side media docs PR (architecture, COI requirements): Docs: Add client-side media processing documentation WordPress/gutenberg#75895
• Core PR - switch to Document-Isolation-Policy: Media: Use Document-Isolation-Policy for cross-origin isolation WordPress/wordpress-develop#11098
• Core PR - skip DIP for third-party page builders (the workaround): Media: Skip cross-origin isolation for third-party page builders WordPress/wordpress-develop#11170

Elementor:

• Existing temporary replace_editor fix: Fix: Elementor Editor Broken on WordPress 7.0 beta [ED-23138] #34900
• Related (CSP / modern security headers): Add CSP (Content Security Policy) header support to Elementor #15192

Web platform:

• Document-Isolation-Policy explainer: https://developer.chrome.com/blog/document-isolation-policy
• SharedArrayBuffer cross-origin isolation requirements: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/SharedArrayBuffer#security_requirements