SiteTidy
Home /Tools /Permissions-Policy Generator

Permissions-Policy Generator

Control browser features and APIs with a Permissions-Policy header.

Permissions-Policy Gen

Visually construct a Permissions-Policy header to control browser features like camera, geolocation, and more. Highly recommended for modern security.

Feature Control Directives

geolocation

Controls access to the Geolocation interface.

camera

Controls access to video input devices.

microphone

Controls access to audio input devices.

fullscreen

Controls whether the document can request fullscreen.

payment

Controls access to the Payment Request API.

usb

Controls access to the WebUSB API.

magnetometer

Controls access to magnetometer sensors.

gyroscope

Controls access to gyroscope sensors.

accelerometer

Controls access to accelerometer sensors.

autoplay

Controls access to autoplaying media without interaction.

document-domain

Controls setting document.domain.

encrypted-media

Controls access to Encrypted Media Extensions.

Header Output
Generated Payload
Permissions-Policy:"text-cyan-400 font-bold">geolocation="text-red-400 font-bold">(), "text-cyan-400 font-bold">camera="text-red-400 font-bold">(), "text-cyan-400 font-bold">microphone="text-red-400 font-bold">(), "text-cyan-400 font-bold">fullscreen="text-emerald-400 font-bold">(self), "text-cyan-400 font-bold">payment="text-red-400 font-bold">(), "text-cyan-400 font-bold">usb="text-red-400 font-bold">(), "text-cyan-400 font-bold">magnetometer="text-red-400 font-bold">(), "text-cyan-400 font-bold">gyroscope="text-red-400 font-bold">(), "text-cyan-400 font-bold">accelerometer="text-red-400 font-bold">(), "text-cyan-400 font-bold">autoplay="text-emerald-400 font-bold">(self), "text-cyan-400 font-bold">document-domain="text-red-400 font-bold">(), "text-cyan-400 font-bold">encrypted-media="text-emerald-400 font-bold">(self)

Implementation Guide

Add this header to your server configuration to enforce strict feature controls. It protects your site from embedded third-party scripts trying to access sensitive device hardware.

  • () Completely disables the feature.
  • (self) Allows only your domain to use it.
  • "origin" Custom URLs require double quotes.

What is Permissions-Policy?

Permissions-Policy (formerly known as Feature-Policy) provides a mechanism to explicitly declare which powerful features and APIs can be used in a document and any embedded iframes.

By restricting access to features like the camera, microphone, or geolocation, you can improve user privacy, enforce best practices, and lock down your application's security posture.

Syntax Changes

The syntax for this header has evolved from the old Feature-Policy syntax. The current standard uses structured headers:

  • Features are separated by commas (,).
  • The allowlist is enclosed in parentheses (e.g., camera=(self)).
  • To completely disable a feature, use empty parentheses (e.g., camera=()).
  • Specific origins must be enclosed in double quotes (e.g., camera=("https://example.com")).

Related Guides

Deepen your understanding with our expert articles.

The Ultimate Guide to Meta Tags for SEORead guide →