Permissions-Policy

Declares which browser features your page and its embedded frames may use.

Recommended value

What it does

Formerly Feature-Policy. It gates access to camera, microphone, geolocation, payment, USB, sensors and more.

The reason to set it is embedded content. A third-party frame in your page can prompt for camera or location access, and to the user that prompt appears to come from your site. Denying features you do not use costs nothing and removes the possibility.

The syntax is unusual: an empty allowlist () means "no origin, including me". (self) permits your own origin. A missing header means everything is permitted by default.

Sites sending this header

Found while scanning 188 well-known sites on 2026-08-04:

Check a site