Permissions-Policy Builder
Switch off the camera, microphone, location and other features your site never needs, and allow only the sites you trust to use the rest.
Worked examples
Block the camera, allow location for your own site
Camera: block for everyone. Location: my own site only.
Permissions-Policy: camera=(), geolocation=(self)
The empty brackets mean nobody may use the feature.
About Permissions-Policy Builder
Browsers give pages access to powerful features: the camera, the microphone, the visitor's location, payment requests, USB devices and more. Each has its own permission prompt, but a script on your page, or on a site you embed in a frame, can ask for any of them unless you say otherwise. The Permissions-Policy header lets you decide in advance which features your pages, and the frames inside them, may use at all.
This builder lists the common features and lets you set each one: leave it to the browser, block it for everyone, allow only your own site, allow any site, or allow your own site plus sites you name. It writes the header in the current format with the right brackets and quotes, and if you embed frames it also shows the matching allow attribute. Quick buttons block a set of sensitive features in one go, so you can start strict and open up only what your site genuinely uses.
How to use Permissions-Policy Builder
- Press Block sensitive features to start strict, or set each feature yourself.
- For any feature your site needs, choose My own site only or name the sites you trust.
- Copy the finished header into your hosting settings or web server.
- Test the pages that use maps, video calls, payments or sharing.
Common uses
- Switching off features a marketing site never needs
- Stopping an embedded advert from asking for the camera
- Allowing a payment provider's frame to take payments only
- Preparing a site for a security questionnaire
Frequently asked questions
What does a feature set to nothing do?
The browser will not let your page, or any frame in it, use the feature, and the visitor will not even see a prompt. This protects you from a compromised script, but it also blocks your own code, so only block what you do not use.
How is this different from the old Feature-Policy header?
Permissions-Policy replaced it and uses a different format, with brackets and quoted web addresses. Use this header on new sites. This page writes the current format.
What is the allow attribute for?
It sets the same kind of rule for a single frame. For example a frame that shows a video call can be given the camera and microphone while the rest of the page cannot use them.
What happens to features I leave unset?
They keep the browser default. For most features that means your own site can use them and frames from other sites cannot unless the frame tag allows it.
Do I need this if I already have a Content-Security-Policy?
They do different jobs. A Content-Security-Policy controls where content loads from, and a Permissions-Policy controls which browser features may be used. They work well together.