Skip to content
AZ Tools

Permissions-Policy Header Builder

The Permissions-Policy header is the modern replacement for Feature-Policy: it tells the browser which features your page and its iframes are allowed to use. Pick each feature one at a time and choose whether it's blocked entirely, allowed only for the same origin, allowed for any origin, or limited to a custom list. The tool tags the well-known features (camera, microphone, geolocation, payment, USB, etc.) by category so you don't miss the one that bites you. Warnings catch unsafe defaults — wildcards that hand the feature to every embedded origin, custom lists missing a scheme.

—
Presets
Sensors
  • accelerometer
    Read accelerometer
  • gyroscope
    Read gyroscope
  • magnetometer
    Read magnetometer
  • ambient-light-sensor
    Read ambient light
Media capture
  • camera
    Use the user's camera
  • microphone
    Use the user's microphone
  • autoplay
    Autoplay media
  • display-capture
    Screen-share via getDisplayMedia
  • speaker-selection
    Pick output audio device
Payment & auth
  • payment
    Use the Payment Request API
  • publickey-credentials-get
    Use WebAuthn
Display
  • fullscreen
    Programmatically go fullscreen
  • picture-in-picture
    Open PIP video
  • screen-wake-lock
    Keep the screen awake
  • xr-spatial-tracking
    Use WebXR spatial tracking
Other
  • geolocation
    Read user location
  • clipboard-read
    Read clipboard contents
  • clipboard-write
    Write to clipboard
  • usb
    Use Web USB
  • serial
    Use Web Serial
  • bluetooth
    Use Web Bluetooth
  • idle-detection
    Detect user idle
  • midi
    Use Web MIDI
  • web-share
    Use the Web Share API
Response header
Permissions-Policy: autoplay=(self), fullscreen=(self), picture-in-picture=(self), clipboard-write=(self), web-share=(self)

Apply on every HTML response. Use Report-To + the `report-uri` directive (not built here) if you want browsers to send violations back to a collector.

How to use

  1. Start with the strict preset (everything off) and turn on only what your page actually needs.
  2. `self` is the right answer for most page-level features. `*` is rarely the right answer — it lets every iframe use the feature.
  3. Custom mode takes an allowlist of origins (`https://embed.example.com https://other.com`). `self` and `*` are tokens, anything else needs the full origin.

Frequently asked questions

Permissions-Policy vs Feature-Policy?
Same idea, new syntax. Feature-Policy used a space-separated list of origins per directive; Permissions-Policy uses structured-headers `feature=(origin1 origin2)`. Browsers honour Permissions-Policy now; serve both during the transition window if you support old browsers.
Why is wildcard `*` risky?
Wildcard hands the feature to every nested iframe — including third-party embeds you don't fully trust. If a malvertising or supply-chain compromise injects an iframe, `*` is the difference between 'they can spy with the camera' and 'they can't.'

Related tools

Referrer-Policy Header Builder

Pick a Referrer-Policy value and see exactly what `Referer` header outbound requests will send — same-origin, cross-origin HTTPS, HTTPS→HTTP downgrade.

Network 0 0

Content-Security-Policy Builder

Build a CSP header from per-directive source lists, with three starter presets and live warnings for the dangerous wildcards.

Network 0 0

SPF Record Builder

Compose a Sender Policy Framework TXT record from mechanisms, IPs and includes — with a live DNS-lookup counter and warnings.

Network 0 0

Cache-Control Header Builder

Build an HTTP Cache-Control header from a visual checklist — freshness, revalidation, immutability, and the common presets.

Network 0 0

HSTS Header Builder

Compose a Strict-Transport-Security header — max-age, includeSubDomains, preload — with a live preload-list eligibility check.

Network 0 0

Cookie / Set-Cookie Header Builder

Compose a `Set-Cookie` response header from name/value plus the security attributes — SameSite, Secure, HttpOnly, Partitioned, Max-Age — with safety warnings.

Network 0 0