Permissions-Policy

What it means

Permissions-Policy is an HTTP response header that tells the browser which powerful features your page, and any frames inside it, may use. Examples are camera, microphone, geolocation, payment and fullscreen. Anything you do not allow is switched off.

It was previously called Feature-Policy. The syntax is a list such as camera=(), geolocation=(self), where empty parentheses mean no one may use the feature and self means only your own origin.

Why it matters

Your page often contains code you did not write: ad scripts, chat widgets, embedded videos, a compromised dependency. If a feature is not locked, that code can ask the visitor for the camera or location under your site's name, and people tend to trust your name.

Switching off what you do not use reduces what a mistake or an injected script can do. It is a small control with an unusual property: nothing to maintain once set, and a clear answer for a security reviewer.

How it shows up

You meet it in response headers from the web server, CDN or framework. It works alongside the allow attribute on iframes, where you give a specific frame a specific feature. Browser support varies by feature, and some browsers still lag.

The mistakes repeat. No header at all. A copy-pasted policy that disables features the app really uses, so a video call breaks. Granting a feature to *. Forgetting that embedded frames from other sites inherit the choice. Start with everything off and open only what you need. See security headers.