Online Permissions-Policy Header Builder & Tester
Configure modern browser Permissions-Policy (formerly Feature-Policy) HTTP headers. Restrict camera, microphone, geolocation, screen capture, and payment APIs from being abused by embedded third-party iframes.
1. Feature Directives
2. Generated Policy Header
IFRAME ALLOW ATTRIBUTE:
NGINX CONFIG SNIPPET:
Why Permissions-Policy Matters for Web Security
Modern websites frequently embed third-party advertising scripts, widgets, and analytics inside iframes. Without a strict Permissions-Policy, compromised or malicious embedded frames could attempt to prompt users for camera access, microphone recordings, or geographic location.
Directive Syntax Values
(): Completely disabled for all browsing contexts, including the top-level document.(self): Allowed only for documents originating from the exact same origin (protocol, domain, port).*: Allowed for all origins (strongly discouraged for sensitive APIs like camera or mic).("https://cdn.example.com"): Permitted specifically for designated trusted origins.