How to add Permissions-Policy on Netlify
Last updated · Reviewed by a CISSP-certified security practitioner
To add Permissions-Policy on Netlify, set the header in _headers (in publish directory) with the value camera=(), microphone=(), geolocation=(), payment=(), usb…. Turns off browser features (camera, mic, geolocation) you don't use. Redeploy; check Deploy summary → Headers rules processed. Then confirm it with curl -I or a free FixSecurityHeaders scan.
What does Permissions-Policy do?
Permissions-Policy disables powerful browser APIs for your page and any embedded iframes unless you explicitly allow them.
Risk if missing: Injected or third‑party scripts could request camera, microphone, geolocation or payment APIs.
What is the Netlify configuration?
Add this to _headers (in publish directory):
/*
Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), interest-cohort=()How do I add it step by step?
- Open _headers (in publish directory).
- Paste the Permissions-Policy configuration shown below.
- Redeploy; check Deploy summary → Headers rules processed.
- Run curl -I https://yourdomain.com and look for the permissions-policy line.
- Scan your site on FixSecurityHeaders to confirm the grade improved.
How do I verify it worked?
curl -sI https://yourdomain.com | grep -i "permissions-policy"
# expected:
# permissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), interest-cohort=()Check your site now
Free scan, instant grade, exact fixes for your stack.
What are the common mistakes?
- Allow features you actually use, e.g. payment=(self) for Payment Request checkouts.
- The _headers file must end up in your publish directory (e.g. public/).
- Indent header lines under the path pattern.
Quick reference
| Header | Permissions-Policy |
|---|---|
| Recommended value | camera=(), microphone=(), geolocation=(), payment=(), usb=(), interest-cohort=() |
| Stack | Netlify |
| Where | _headers (in publish directory) |
| Compliance | OWASP ASVS V14.4, SOC 2 CC6.8 |
FAQ
What value should I use for Permissions-Policy?
A safe default is camera=(), microphone=(), geolocation=(), payment=(), usb=(), interest-cohort=(). Allow features you actually use, e.g. payment=(self) for Payment Request checkouts.
Why isn't Permissions-Policy showing up on Netlify?
The _headers file must end up in your publish directory (e.g. public/). Also clear any CDN or page cache, and check you edited the config that actually serves your domain.
Does Permissions-Policy affect SEO or performance?
No measurable performance cost — it's a few bytes per response. It doesn't affect rankings directly, but a misconfigured policy can break page resources, so test before enforcing.
Which compliance frameworks reference Permissions-Policy?
OWASP ASVS V14.4, SOC 2 CC6.8.