Glossary · Security

Permissions-Policy

Permissions-Policy is a response header that allows or blocks browser features such as camera, microphone and geolocation for a site and its frames.

Updated October 6, 2026

Permissions-Policy is an HTTP header that lets a site declare which powerful browser features, such as camera, microphone, geolocation or payment, may be used by its own pages and by third-party content embedded in them. It replaced the older Feature-Policy header.

Why it matters

Pages often include third-party iframes or scripts. Without a policy, a compromised or careless embed might request sensitive capabilities in your site's context. Turning off features you never use limits that exposure and also reduces accidental use. It is a defence-in-depth measure, not a replacement for user permission prompts.

Example

Permissions-Policy: camera=(), microphone=(), geolocation=(self)

Here camera=() and microphone=() disable those features for everyone. geolocation=(self) allows only the site's own origin. A frame can be given access through the allow attribute, as in <iframe allow="geolocation">, if the policy permits it.

Common mistakes

  • Using the old Feature-Policy syntax in the new header.
  • Blocking a feature the site needs, such as microphone on a video call page.
  • Assuming support is identical in all browsers; check current compatibility.
  • Forgetting that embedded content needs an explicit grant.

Get notified when this term updates

Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.

Keep reading

Glossary · SecurityCookie Prefixes (__Host- and __Secure-)Cookie prefixes are name prefixes that make browsers enforce extra rules, such as Secure and no Domain attribute, on that cookie.Glossary · SecurityCORS (Cross-Origin Resource Sharing)CORS is a browser mechanism that uses HTTP headers to let a server permit specific other origins to read its responses, relaxing the same-origin policy.Glossary · SecurityCORS Preflight RequestA CORS preflight is an automatic OPTIONS request a browser sends to check whether a cross-origin request is allowed before sending it.Guide · SSL & SecurityContent Security Policy (CSP) Guide: Directives, Nonces, RolloutBuild a Content Security Policy that works: key directives, nonces and strict-dynamic, Report-Only rollout, violation reports, and fixes for common breakage.7 min readGuide · SSL & SecurityCookie Flags Explained: Secure, HttpOnly and SameSiteWhat the Secure, HttpOnly, SameSite, Domain, Path and cookie prefix attributes do, how to set them in common stacks, and how to debug cookies that go missing.7 min readGuide · Web BasicsHow to Read HTTP Headers for Beginners (What Each Line Tells You)Learn to view and read HTTP response headers with a free tool or curl, and what status, server, cache, redirect and security headers mean for your website.7 min read

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.