Security · Response header
Permissions-Policy
Controls which browser features and APIs pages can use.
What is Permissions-Policy?
Permissions-Policy (formerly Feature-Policy) declares whether the page and its iframes may use APIs like camera, microphone, geolocation, and — importantly — FLoC / interest-cohort tracking.
Typical usage
Set on HTML responses to lock down unused features.
Examples
Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()Specification
W3C Permissions Policy
Frequently asked questions
What is the Permissions-Policy HTTP header?
Permissions-Policy (formerly Feature-Policy) declares whether the page and its iframes may use APIs like camera, microphone, geolocation, and — importantly — FLoC / interest-cohort tracking.
Is Permissions-Policy a request or response header?
Permissions-Policy is a response header — the server sends it to the client. Set on HTML responses to lock down unused features.
What does a Permissions-Policy header look like?
A typical Permissions-Policy header looks like: Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=().
Related headers
Strict-Transport-Security
Force browsers to use HTTPS for a domain (HSTS).
Content-Security-Policy
The primary defense against XSS: whitelist trusted sources.
X-Frame-Options
Prevents clickjacking by controlling framing.
X-Content-Type-Options
Disables MIME-type sniffing.
Referrer-Policy
Controls the Referer header sent on outgoing links and requests.