Skip to content
Skip to content
API Pricing RU Sign In
← All HTTP Headers
Security

Permissions-Policy

Controls which browser features and APIs can be used on the page, such as camera, microphone, and geolocation.

Syntax

Permissions-Policy: <feature>=(<allowlist>), <feature>=(<allowlist>)

Example

Permissions-Policy: camera=(), microphone=(), geolocation=()

Description

Permissions-Policy (formerly Feature-Policy) controls which browser features and APIs are available. Prevents third-party scripts from abusing camera, microphone, geolocation, or payment APIs.

Each feature can be: * (allow all), self (same origin), specific origins, or () (disable).

Important for sites with third-party content — restricting permissions limits potential damage from compromised scripts.

Check if your website sends this header correctly

Check your headers →

Related Articles

Web Server Security Hardening Checklist: Nginx and Apache
Complete web server hardening checklist for nginx and Apache. File permissions, security headers, TLS configuration, access control, and monitoring.
Security Headers: The Complete Guide
Complete guide to HTTP security headers: CSP, HSTS, X-Frame-Options, Permissions-Policy, CORP, COEP. Configuration and examples.
Analyzing Server Response Headers: What They Reveal About a Website
A detailed guide to HTTP headers: Cache-Control, ETag, Server, CORS, and security headers. How to read and optimize response headers.

Related Headers

Content-Security-Policy
Controls which resources the browser is allowed to load for a page, helping prevent XSS and data injection attacks.
Cross-Origin-Opener-Policy
Isolates the browsing context to prevent cross-origin attacks like Spectre from accessing sensitive data.
Cross-Origin-Resource-Policy
Restricts which origins can load a resource, preventing unauthorized cross-origin reads.
Referrer-Policy
Controls how much referrer information is included with requests, balancing privacy with analytics needs.
Strict-Transport-Security
Instructs browsers to only access the site via HTTPS, protecting against protocol downgrade attacks and cookie hijacking.
X-Content-Type-Options
Prevents browsers from MIME-sniffing the content type, reducing the risk of drive-by downloads and XSS attacks.

Start monitoring for free

Sign up and get access to API, monitoring and notifications

Create Account API Documentation