Permissions-Policy (Feature-Policy) Studio

Configure and generate modern W3C Permissions-Policy HTTP headers to control browser APIs and hardware access

Policy Presets

Load recommended security profiles for web applications

Browser Features & Hardware Directives

Configure execution privileges for browser subsystems

15 blocked

1 allowed

Media & Screen Capture

camera

Access video input devices like webcams

microphone

Access audio input devices like microphones

speaker-selection

Enumerate and select audio output devices

display-capture

Capture contents of the screen or display surfaces

Sensors & Geolocation

geolocation

Access geographic location coordinates

accelerometer

Measure device motion along 3 axes

gyroscope

Measure device orientation and rate of rotation

magnetometer

Detect magnetic field changes (compass orientation)

Hardware & Network

payment

Invoke Payment Request API for web payments

usb

Communicate directly with USB peripherals

serial

Communicate with serial ports and microcontroller boards

bluetooth

Connect and exchange data with Bluetooth Low Energy devices

Screen & Navigation

fullscreen

Request fullscreen display of elements

picture-in-picture

Play floating video windows outside the tab

screen-wake-lock

Prevent device screen from dimming or locking

autoplay

Automatically start playback of audio or video elements

Generated Header & Framework Snippets

W3C Spec

Permissions-Policy: camera=(), microphone=(), speaker-selection=(), display-capture=(), geolocation=(), accelerometer=(), gyroscope=(), magnetometer=(), payment=(), usb=(), serial=(), bluetooth=(), fullscreen=(self), picture-in-picture=(), screen-wake-lock=(), autoplay=()

// In next.config.mjs headers or proxy.ts
{
  key: 'Permissions-Policy',
  value: 'camera=(), microphone=(), speaker-selection=(), display-capture=(), geolocation=(), accelerometer=(), gyroscope=(), magnetometer=(), payment=(), usb=(), serial=(), bluetooth=(), fullscreen=(self), picture-in-picture=(), screen-wake-lock=(), autoplay=()'
}

add_header Permissions-Policy "camera=(), microphone=(), speaker-selection=(), display-capture=(), geolocation=(), accelerometer=(), gyroscope=(), magnetometer=(), payment=(), usb=(), serial=(), bluetooth=(), fullscreen=(self), picture-in-picture=(), screen-wake-lock=(), autoplay=()" always;

<meta http-equiv="Permissions-Policy" content="camera=(), microphone=(), speaker-selection=(), display-capture=(), geolocation=(), accelerometer=(), gyroscope=(), magnetometer=(), payment=(), usb=(), serial=(), bluetooth=(), fullscreen=(self), picture-in-picture=(), screen-wake-lock=(), autoplay=()">

Modern Security Standard

Permissions-Policy replaces legacy Feature-Policy. Deploy this header via reverse proxy, CDN, or server response to harden browser attack surface.

Permissions-Policy: camera=(), microphone=(), speaker-selection=(), display-capture=(), geolocation=(), accelerometer=(), gyroscope=(), magnetometer=(), payment=(), usb=(), serial=(), bluetooth=(), fullscreen=(self), picture-in-picture=(), screen-wake-lock=(), autoplay=()

// In next.config.mjs headers or proxy.ts { key: 'Permissions-Policy', value: 'camera=(), microphone=(), speaker-selection=(), display-capture=(), geolocation=(), accelerometer=(), gyroscope=(), magnetometer=(), payment=(), usb=(), serial=(), bluetooth=(), fullscreen=(self), picture-in-picture=(), screen-wake-lock=(), autoplay=()' }

add_header Permissions-Policy "camera=(), microphone=(), speaker-selection=(), display-capture=(), geolocation=(), accelerometer=(), gyroscope=(), magnetometer=(), payment=(), usb=(), serial=(), bluetooth=(), fullscreen=(self), picture-in-picture=(), screen-wake-lock=(), autoplay=()" always;