How to add Permissions-Policy on Cloudflare
Last updated · Reviewed by a CISSP-certified security practitioner
To add Permissions-Policy on Cloudflare, set the header in Rules → Transform Rules → Modify Response Header (or a Worker) with the value camera=(), microphone=(), geolocation=(), payment=(), usb…. Turns off browser features (camera, mic, geolocation) you don't use. Purge cache, then check the response with curl -I. Then confirm it with curl -I or a free FixSecurityHeaders scan.
What does Permissions-Policy do?
Permissions-Policy disables powerful browser APIs for your page and any embedded iframes unless you explicitly allow them.
Risk if missing: Injected or third‑party scripts could request camera, microphone, geolocation or payment APIs.
What is the Cloudflare configuration?
Add this to Rules → Transform Rules → Modify Response Header (or a Worker):
// Option A: Rules → Transform Rules → Modify Response Header → "Set static"
// Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), interest-cohort=()
// Option B: Cloudflare Worker
export default {
async fetch(request, env, ctx) {
const res = await fetch(request);
const out = new Response(res.body, res);
const h = out.headers;
h.set("Permissions-Policy", "camera=(), microphone=(), geolocation=(), payment=(), usb=(), interest-cohort=()");
return out;
},
};How do I add it step by step?
- Open Rules → Transform Rules → Modify Response Header (or a Worker).
- Paste the Permissions-Policy configuration shown below.
- Purge cache, then check the response with curl -I.
- Run curl -I https://yourdomain.com and look for the permissions-policy line.
- Scan your site on FixSecurityHeaders to confirm the grade improved.
How do I verify it worked?
curl -sI https://yourdomain.com | grep -i "permissions-policy"
# expected:
# permissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), interest-cohort=()Check your site now
Free scan, instant grade, exact fixes for your stack.
What are the common mistakes?
- Allow features you actually use, e.g. payment=(self) for Payment Request checkouts.
- Transform Rules work on all plans; Workers give full control.
- Cloudflare's own HSTS setting lives under SSL/TLS → Edge Certificates.
Quick reference
| Header | Permissions-Policy |
|---|---|
| Recommended value | camera=(), microphone=(), geolocation=(), payment=(), usb=(), interest-cohort=() |
| Stack | Cloudflare |
| Where | Rules → Transform Rules → Modify Response Header (or a Worker) |
| Compliance | OWASP ASVS V14.4, SOC 2 CC6.8 |
FAQ
What value should I use for Permissions-Policy?
A safe default is camera=(), microphone=(), geolocation=(), payment=(), usb=(), interest-cohort=(). Allow features you actually use, e.g. payment=(self) for Payment Request checkouts.
Why isn't Permissions-Policy showing up on Cloudflare?
Transform Rules work on all plans; Workers give full control. Also clear any CDN or page cache, and check you edited the config that actually serves your domain.
Does Permissions-Policy affect SEO or performance?
No measurable performance cost — it's a few bytes per response. It doesn't affect rankings directly, but a misconfigured policy can break page resources, so test before enforcing.
Which compliance frameworks reference Permissions-Policy?
OWASP ASVS V14.4, SOC 2 CC6.8.