Security Headers Checker / Headers
Permissions-Policy: switch off browser features you do not use
Permissions-Policy decides which browser features (camera, microphone, geolocation, payment, USB, fullscreen…) the page and the frames inside it may use. Switching off what you do not use means a compromised script or a malicious frame cannot use it either.
What to send
Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), browsing-topics=()
() switches a feature off everywhere; (self) allows your own origin; (self "https://maps.example") also allows that embed. Our checker reads your page and keeps features it uses on in its suggestion.
# server { } block (or a file included in every server block).
# "always" also sends the header on error and redirect responses.
add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=(), browsing-topics=()" always;Will this break anything?
- Permissions-Policy: a feature set to () is off for the page and every frame in it, including embedded maps, videos, payment buttons and chat widgets. Check what your page and its embeds use first.
How our grade counts it
- Coverage, up to 5 points: a policy that parses as a structured header; N/A for API responses
Common mistakes
- The old Feature-Policy syntax (quotes, semicolons): browsers reject the whole header.
- Switching off a feature the page or an embed uses (a map's geolocation, a video's autoplay or fullscreen, a payment button).
Check your site
The checker reads Permissions-Policy the way a browser applies it, alongside every other security header.
Open the Security Headers Checker