Permissions-Policy Header Generator

The Permissions-Policy header (formerly known as Feature-Policy) is a security mechanism that allows web developers to control which browser features and APIs can be used by their website and embedded third-party content. By setting this header, you can enable, disable, or restrict access to features like camera, microphone, geolocation, and more — either for your own origin or for cross-origin iframes. This helps protect user privacy and reduce the attack surface of your web application.

Feature-Policy was the original header name, introduced in 2018. In 2020, the specification was renamed to Permissions-Policy with an updated syntax and broader scope. Key differences include:

• Syntax: Feature-Policy used a whitelist-based syntax with semicolons; Permissions-Policy uses a structured field format with commas.
• Default allowlist: Permissions-Policy defaults to * (allow all) for most features, whereas Feature-Policy had varying defaults.
• Scope: Permissions-Policy covers more features and is actively maintained by the W3C.

Modern browsers support both headers for backward compatibility, but Permissions-Policy is the recommended standard going forward.

Apache (.htaccess or httpd.conf):

Header always set Permissions-Policy "camera=self, microphone=()"

Nginx:

add_header Permissions-Policy "camera=self, microphone=()";

Cloudflare / CDN: Most CDNs allow adding custom HTTP headers through their dashboard or configuration files.

Use the Nginx and Apache copy buttons above to get server-specific formatted output.

• * (Allow All): The feature is allowed in all browsing contexts, including cross-origin iframes. This is the default for most features.
• self (Self Only): The feature is only allowed in same-origin browsing contexts and not in cross-origin iframes.
• () (Block All / None): The feature is completely blocked for all contexts, including your own origin.
• Custom origins: You can specify specific origins like ("https://trusted.com") to allow the feature only for those origins.

• Strict: Best for high-security sites (banking, healthcare). Blocks all sensitive features. Only use if you're certain no features are needed.
• Moderate: Recommended for most websites. Allows common features for your own origin while blocking them for third-party iframes.
• Permissive: Suitable for sites that heavily rely on browser APIs and embed trusted third-party content.

Start with Moderate and adjust individual permissions based on your site's specific needs.

1. Browser DevTools: Open Network tab, look for the response headers of your main document. You should see Permissions-Policy listed.
2. JavaScript check: In the console, run: document.featurePolicy.allowedFeatures() (for older Feature-Policy) or check specific features with navigator.permissions.query().
3. Online scanners: Use security headers scanners like securityheaders.com to verify your configuration.
4. Console errors: When a feature is blocked, the browser console will show a warning like: "...feature is disabled by permissions policy."