Permissions-Policy Header Generator

About this tool

The Permissions-Policy response header tells browsers which powerful features a page, and the pages embedded in it, may use: camera, microphone, geolocation, payment, USB, fullscreen and more. Switching off what you do not need limits the damage if a script on your site, or an embedded advertisement or widget, tries to use it. For each of 33 features choose: leave at the browser default, nobody, your own pages only, everyone including embedded content, or a list of specific origins such as https://maps.example.com, with or without your own pages. Presets give a locked-down start. The tool writes the header value and wraps it for the place you will put it: a plain header, nginx add_header, an Apache Header directive, a _headers file for Cloudflare Pages or Netlify, netlify.toml, vercel.json, Express, or a Cloudflare Worker. The value is a Structured Fields dictionary, so the syntax is strict: features are separated by commas, an allowlist is in parentheses, and origins are in double quotes. We parsed 60 random generated headers with Python's http_sfv, which implements RFC 8941, and served one with every kind of rule to Chrome, which then reported for each feature, for your own origin and for others, exactly the access the header describes, without a warning, and knows every feature name we use. A few things to know: the header cannot be set in a meta tag, a feature that you leave unset keeps the browser's default, browsers ignore feature names they do not know, and an iframe can still be given less than the header allows through its allow attribute but never more. Nothing is uploaded.

How to use it

1. Pick a preset, or set each feature you care about.
2. For specific origins, enter one per line, such as https://example.com.
3. Choose where you will put the header.
4. Copy the result and add it to your server or hosting settings.

Common problems

It says an origin is not valid

An origin has a scheme and a host, optionally a port, and no path: https://example.com or https://*.example.com. Remove paths and query strings.

The header has no effect

Check that your server really sends it (look at the response headers in your browser's developer tools), and that the feature name is spelled as in the list.

An embedded widget stopped working

The widget needs a feature you switched off for embedded content. Allow its origin for that feature, or leave the feature at its default.