# Permissions-Policy Header — Syntax, Values & Examples

> Turns browser features such as the camera, microphone and geolocation on or off for a page and its iframes.

Permissions-Policy (formerly Feature-Policy) lets a site switch off powerful features it doesn't use, so injected code or third-party iframes can't even ask for them. Features you don't mention keep their browser defaults.

- Type: Response header
- Category: Security
- Defined in: [W3C — Permissions Policy](https://www.w3.org/TR/permissions-policy/)

## Syntax

```http
Permissions-Policy: <feature>=<allowlist>, <feature>=<allowlist>…
```

## Values

| Value | Meaning |
|---|---|
| `()` | disabled everywhere |
| `(self)` | your origin only |
| `(self "https://maps.example")` | your origin and the listed one |
| `*` | any origin |

## Examples

```http
Permissions-Policy: camera=(), microphone=(), geolocation=()
```

disable features this site never uses

```http
Permissions-Policy: geolocation=(self "https://maps.example.com")
```

allow geolocation for your origin and one embedded map

## Good to know

- Iframes also need the `allow` attribute to use a feature: `<iframe allow="geolocation">`.
- The syntax uses structured fields: lists in parentheses, origins in double quotes.
- `Feature-Policy` is the deprecated predecessor, with a different syntax.

## How to set Permissions-Policy

### Express

```
res.set("Permissions-Policy", "camera=(), microphone=(), geolocation=()");
```

### Next.js (next.config.js)

```
module.exports = {
  async headers() {
    return [
      {
        source: "/(.*)",
        headers: [{ key: "Permissions-Policy", value: "camera=(), microphone=(), geolocation=()" }],
      },
    ];
  },
};
```

### nginx

```
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
```

### Apache (.htaccess)

```
Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
```

## Check it

Fetch only the response headers and filter for Permissions-Policy. In the browser, it's under Response Headers in DevTools → Network.

```sh
curl -sI https://example.com/ | grep -i '^permissions-policy:'
```

## FAQ

### Does Permissions-Policy replace the browser's permission prompt?

No. It decides whether a feature can be requested at all; for features like the camera, the user still sees the browser's own prompt.

## Related headers

- [Content-Security-Policy](https://www.devkult.com/headers/content-security-policy.md): Restricts where a page may load scripts, styles, images and frames from — the main defence against cross-site scripting.
- [Referrer-Policy](https://www.devkult.com/headers/referrer-policy.md): Controls how much of the current URL is sent in the Referer header when users follow links or load resources.
- [Cross-Origin-Opener-Policy](https://www.devkult.com/headers/cross-origin-opener-policy.md): Isolates your page from cross-origin windows that open it or that it opens.

## Further reading

- [Security headers checklist](https://www.devkult.com/blog/security-headers-checklist.md)
- [Security headers generator](https://www.devkult.com/tools/security/security-headers-generator.md)

Open the interactive page: https://www.devkult.com/headers/permissions-policy