Permissions-Policy
Controls which browser features and APIs can be used on the page, such as camera, microphone, and geolocation.
Syntax
Permissions-Policy: <feature>=(<allowlist>), <feature>=(<allowlist>)Example
Permissions-Policy: camera=(), microphone=(), geolocation=()Description
Permissions-Policy (formerly Feature-Policy) controls which browser features and APIs are available. Prevents third-party scripts from abusing camera, microphone, geolocation, or payment APIs.
Each feature can be: * (allow all), self (same origin), specific origins, or () (disable).
Important for sites with third-party content — restricting permissions limits potential damage from compromised scripts.
How real sites send this header
Home-page responses of 503 popular sites from the enterno.io /check catalogue, checked in the last 30 days.
13.5%
(68 of 503) send Permissions-Policy.
See it on: discord.com, cloudflare.com, beget.com, codepen.io, docker.com
Check if your website sends this header correctly
Check your headers →