devkult_
tools29converters34
home/headers/permissions-policy

Permissions-Policy

response headersecurity

Turns browser features such as the camera, microphone and geolocation on or off for a page and its iframes.

Permissions-Policy (formerly Feature-Policy) lets a site switch off powerful features it doesn't use, so injected code or third-party iframes can't even ask for them. Features you don't mention keep their browser defaults.

Syntax

Permissions-Policy: <feature>=<allowlist>, <feature>=<allowlist>…

Defined in W3C — Permissions Policy.

Values

()disabled everywhere
(self)your origin only
(self "https://maps.example")your origin and the listed one
*any origin

Examples

Permissions-Policy: camera=(), microphone=(), geolocation=()

disable features this site never uses

Permissions-Policy: geolocation=(self "https://maps.example.com")

allow geolocation for your origin and one embedded map

Good to know

  • Iframes also need the allow attribute to use a feature: <iframe allow="geolocation">.
  • The syntax uses structured fields: lists in parentheses, origins in double quotes.
  • Feature-Policy is the deprecated predecessor, with a different syntax.

Further reading: Security headers checklist · Security headers generator

How to set Permissions-Policy

Express
res.set("Permissions-Policy", "camera=(), microphone=(), geolocation=()");
Next.js (next.config.js)
module.exports = {
  async headers() {
    return [
      {
        source: "/(.*)",
        headers: [{ key: "Permissions-Policy", value: "camera=(), microphone=(), geolocation=()" }],
      },
    ];
  },
};
nginx
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
Apache (.htaccess)
Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"

Check it

Fetch only the response headers and filter for Permissions-Policy. In the browser, it's under Response Headers in DevTools → Network.

curl -sI https://example.com/ | grep -i '^permissions-policy:'

To compare response headers across many URLs at once, use the HTTP Status Checker.

Frequently asked questions

Does Permissions-Policy replace the browser's permission prompt?

No. It decides whether a feature can be requested at all; for features like the camera, the user still sees the browser's own prompt.

Related headers