Permissions-Policy explained

Last updated November 11, 2026 · Reviewed by a CISSP-certified security practitioner

Permissions-Policy: Permissions-Policy disables powerful browser APIs for your page and any embedded iframes unless you explicitly allow them. Recommended value: camera=(), microphone=(), geolocation=(), payment=(), usb=(), interest-cohort=().

What risk does it prevent?

Injected or third‑party scripts could request camera, microphone, geolocation or payment APIs.

What is the safe recommended value?

Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), interest-cohort=()

What are the gotchas?

Allow features you actually use, e.g. payment=(self) for Payment Request checkouts.

Which compliance controls reference it?

OWASP ASVS V14.4
SOC 2 CC6.8

How do I add it on my stack?

Check your site now

Free scan, instant grade, exact fixes for your stack.

Other security headers

Strict-Transport-Security — Forces browsers to only use HTTPS for your domain.
Content-Security-Policy — Controls which scripts, styles and frames a page may load.
X-Content-Type-Options — Stops browsers from guessing (sniffing) file types.
X-Frame-Options — Prevents your site being embedded in iframes (clickjacking).
Referrer-Policy — Limits how much of your URLs leak to other sites.
Cross-Origin-Opener-Policy — Isolates your window from pop-ups and openers on other sites.
Cross-Origin-Resource-Policy — Stops other sites from loading your resources.
Cross-Origin-Embedder-Policy — Requires embedded resources to opt in (enables cross-origin isolation).