Permissions-Policy (formerly Feature-Policy) is an HTTP response header that controls which browser features — camera, microphone, geolocation, payment, autoplay, USB — a page and its embedded iframes may access. It’s the browser-level equivalent of Android/iOS runtime permissions.
Header Format
Permissions-Policy: camera=(), microphone=(), geolocation=(self), payment=(self "https://payments.example.com")Common Directives
| Feature | Purpose |
|---|---|
camera | getUserMedia video access |
microphone | getUserMedia audio access |
geolocation | HTML5 Geolocation API |
payment | Payment Request API |
autoplay | Media autoplay |
interest-cohort | FLoC / topics API |
usb | WebUSB access |
Deployment Pattern
Deny everything you don’t actually use. A blog post has no reason to request microphone or camera access — even a compromised third-party script embedded in it can’t request them if the header denies.
Common Miss
Not applying to iframes. Third-party embeds (widgets, chat, ads) can request camera/mic access from your users unless Permissions-Policy explicitly forbids it. Set restrictive policies at the parent page level to lock down all iframes.
Audit yours with the security headers checker.
Related
Check the CSP glossary entry, the Referrer-Policy entry, and read the HTTP security headers explainer.