Permissions-Policy
Allows site owners to selectively restrict browser hardware features, sensors, APIs, and privacy-invasive tracking mechanisms.
camera=(), microphone=(), geolocation=(), browsing-topics=()Production Server Implementation
add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), browsing-topics=()" always;Directives & Syntax Breakdown
Completely disables webcam access for this origin and any embedded iframes.
Disables microphone audio recording for the page and third-party widgets.
Blocks GPS location coordinate queries from the browser API.
Opts out of Google Chrome Privacy Sandbox ad tracking and behavioral profiling.
Common Security Hazards & Pitfalls
- •Permissions-Policy replaces the deprecated Feature-Policy header. Ensure you use the newer key-value list syntax.
Permissions-Policy - Questions & Answers
Common implementation questions, browser enforcement rules, and debugging.
Yes! Use "camera=(self), microphone=(self)" to allow your primary application while locking out third-party embedded iframes.
Related HTTP Headers
Browse All HeadersRestricts where scripts, images, styles, and frames can be loaded from, protecting websites from Cross-Site Scripting (XSS) and data injection attacks.
Forces modern web browsers to communicate exclusively over encrypted HTTPS connections, preventing SSL stripping and man-in-the-middle (MITM) attacks.
Indicates whether a browser should be allowed to render a page inside an <iframe>, <frame>, or <object>, protecting users against clickjacking attacks.
Prevents the browser from MIME-sniffing a response away from the declared Content-Type header, mitigating drive-by malware and MIME confusion attacks.
Controls how much referrer information (URL path and query parameters) is included when navigating away or loading external assets.
Specifies browser and CDN caching directives for requests and responses, dramatically accelerating load speeds or preventing cache leakage.