Permissions Policy Generator
Generate a correct Permissions-Policy HTTP header for your website. Choose a preset or toggle individual features such as camera, microphone and geolocation, then copy the ready-to-paste header into your server configuration.
| Feature | Permission | Allowed origins (if set) |
|---|
Header always set Permissions-Policy "..."How to use
- Pick a preset or set each feature yourself: Disabled blocks it everywhere, Self allows only your own pages, Allow all removes the restriction, and Specific origins lets you list trusted domains (space separated).
- The header updates instantly as you change options.
- Click Copy header and paste it into your server configuration (Apache
.htaccess, Nginx config, or your application's response headers).
Note
Permissions-Policy replaced the older Feature-Policy header; modern browsers honor the new name. The generated header controls both your own pages and embedded iframes. Blocking camera, microphone and geolocation is a good default for sites that do not need them. Always test after adding the header — a video call feature, for example, needs camera and microphone allowed on your own origin.
Frequently Asked Questions (FAQ)
What does the Permissions Policy generator do?
It builds a Permissions-Policy HTTP header that controls browser features like camera, microphone and location on your own pages and embedded iframes.
How do I start with a safe default?
Pick a preset — block almost everything, typical safe site or allow basic media — then adjust individual features as needed.
How do I apply the header to my website?
Add the generated header in your server settings or .htaccess file; the tool also offers a ready-made .htaccess snippet to download.
Why should I block camera and microphone by default?
If your site does not need them, blocking them is a good default so a compromised script cannot access a visitor's camera or location.
What should I test after adding the header?
Your site's features — a video call feature, for example, needs camera and microphone allowed on your own origin.