Security Tools

Permissions-Policy Checker

Check whether a website sends a Permissions-Policy header.

Enter a domain to check whether it sends a Permissions-Policy header.

More Security Tools

Referrer-Policy Checker CORS Header Checker X-Content-Type-Options Checker Mixed Content Detector X-Frame-Options Checker Security Headers Checker Content Security Policy (CSP) Checker HTTPS Redirect Checker

JustChecker monitors your security headers continuously and alerts you if any regress.

What Is Permissions-Policy?

The Permissions-Policy header decides which browser features - camera, microphone, geolocation, payment and more - a page and its embedded frames may use. This tool checks whether a site sends it.

When to Use It

When your site embeds third-party widgets or ads.
During security or privacy reviews.

How to Use It

Enter the domain.
Review which features are allowed or disabled.

Understanding the Result

For example camera=(), microphone=(), geolocation=() disables those features for the page and all frames. Allow only what your site actually uses.

Limitations

It replaced the older Feature-Policy header, whose syntax is different. Browser support varies by feature.

Example Header

Permissions-Policy: camera=(), microphone=(), geolocation=(self), payment=(self "https://checkout.example.com")

This disables the camera and microphone everywhere, allows geolocation only for your own origin, and allows the Payment Request API for your site and one payment provider's frame.

Syntax Quick Reference

Value	Meaning
`()`	Disabled for everyone, including your own pages
`(self)`	Allowed for your own origin only
`*`	Allowed for any origin
`(self "https://a.example")`	Your origin and the listed origins

How to Add It

# Nginx
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

# Apache
Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"

Start by disabling what your site never uses; then test pages that embed maps, video or payment widgets.

Check all your security headers at once with the Security Headers Checker, and read our HTTP security headers checklist.

Frequently Asked Questions

It restricts which powerful browser features (camera, microphone, geolocation, and others) a page - and any content embedded within it via iframes - is allowed to access, even if the underlying browser API itself would otherwise permit it.

It's defense-in-depth against a compromised third-party script or a malicious embedded iframe attempting to access a sensitive device feature you never intended to expose in the first place.

It was originally introduced as Feature-Policy - Permissions-Policy is the renamed, refined successor with a similar but not identical syntax, so older documentation referencing Feature-Policy reflects the deprecated predecessor.

It can restrict both - by default it applies to your own page's use of these features as well as any framed/embedded content, though it can be configured to allow specific origins for embedded iframes.

It's a lower-priority header for sites that genuinely never touch camera/microphone/geolocation-style APIs, but it costs nothing to add and closes off any risk from third-party embedded content misusing those features.

Some directives can restrict resource-intensive browser features (background sync, certain autoplay behaviors) that aren't strictly security-related, offering a minor performance/battery-life benefit alongside the security purpose.