diff --git a/includes/security.php b/includes/security.php
index 7d25762..dd9e98b 100644
--- a/includes/security.php
+++ b/includes/security.php
@@ -209,7 +209,8 @@ function setSecurityHeaders() {
     // Isolation cross-origin
     header('Cross-Origin-Resource-Policy: same-origin');
     header('Cross-Origin-Opener-Policy: same-origin');
-    header('Cross-Origin-Embedder-Policy: require-corp');
+    // COEP retiré : require-corp bloque les iframes/images/vidéos cross-origin (PeerTube, Mastodon, Castopod, Funkwhale)
+    // car ces services ne renvoient pas le header CORP approprié.
 
     // Permissions Policy (feature policy)
     header('Permissions-Policy: accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(), encrypted-media=(), fullscreen=(self), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(self), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), web-share=(), xr-spatial-tracking=()');