headers6 min readUpdated 2026-01-03
Permissions-Policy
Permissions-Policy (formerly Feature-Policy) is a whitelist for browser capabilities. If your site does not need the camera, block it — and if it's ever compromised, attacker JavaScript can't turn it on either.
Baseline for a normal site
camera=(), microphone=(), geolocation=(), interest-cohort=() disables the four APIs almost no marketing site should ever use.
Third-party iframes
Use allow= attributes on the iframe rather than opening up the parent policy — the parent header should stay tight.
Frequently asked questions
Try it on your site
Run a free Website Auditor scan and see which of these controls you're missing.
Run a scan