Permissions-Policy
Permissions-Policy (the successor to Feature-Policy) lets you allow or deny powerful browser features — camera, microphone, geolocation, payment, and dozens more — per origin. Disabling features you do not use shrinks your attack surface and limits what injected or third-party code can do.
Why it matters
Restricts which browser features (camera, microphone, geolocation) the page can use, limiting attack surface.
How to add Permissions-Policy
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;Recommended value
camera=(), microphone=(), geolocation=()Avoid
(header absent) — every embedded frame can request any featureFrequently asked questions
What does camera=() mean?
An empty allow-list, (), disables the feature for every origin including your own page. To allow it only for your own site use camera=(self).
Is Permissions-Policy the same as Feature-Policy?
It is the modern replacement. The syntax changed from Feature-Policy (space-separated) to Permissions-Policy (structured, comma-separated). Send Permissions-Policy; Feature-Policy is deprecated.
Related reading
Other header guides
What the HSTS header does, how to configure max-age, includeSubDomains and preload, and how to add it in Nginx, Apache, and Cloudflare.
Why the X-Content-Type-Options: nosniff header matters, what MIME sniffing is, and how to set it in Nginx, Apache, and Cloudflare.
How X-Frame-Options prevents clickjacking, DENY vs SAMEORIGIN, why frame-ancestors supersedes it, and how to set it in Nginx, Apache, and Cloudflare.
The X-XSS-Protection header is a legacy filter that can introduce vulnerabilities. Learn why modern guidance is to set it to 0 and rely on CSP.
Is Permissions-Policy set on your site?
Scan any URL free to check Permissions-Policy and every other security header.
Scan Now - Free