Security · Response header
Permissions-Policy
Controls which browser features and APIs pages can use.
What is Permissions-Policy?
Permissions-Policy (formerly Feature-Policy) declares whether the page and its iframes may use APIs like camera, microphone, geolocation, and — importantly — FLoC / interest-cohort tracking.
Typical usage
Set on HTML responses to lock down unused features.
Examples
Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()Specification
W3C Permissions Policy
Related headers
Strict-Transport-Security
Force browsers to use HTTPS for a domain (HSTS).
Content-Security-Policy
The primary defense against XSS: whitelist trusted sources.
X-Frame-Options
Prevents clickjacking by controlling framing.
X-Content-Type-Options
Disables MIME-type sniffing.
Referrer-Policy
Controls the Referer header sent on outgoing links and requests.