Permissions-Policy Header Builder

Choose which origins may use powerful browser features and generate both an HTTP header and iframe allow attribute.

Motion sensor acceleration

Automatic media playback

Camera access

Read the clipboard

Write to the clipboard

Screen capture

Fullscreen presentation

Location access

Motion sensor rotation

Microphone access

MIDI devices

Payment Request API

Picture-in-picture video

Create passkeys

Use passkeys

Prevent screen sleep

Serial devices

USB devices

System sharing

Immersive XR tracking

HTTP response header

Copy-ready output from the selected rules.

Permissions-Policy: accelerometer=(), autoplay=(), camera=(), clipboard-read=(), clipboard-write=(self), display-capture=(), fullscreen=(self), geolocation=(), gyroscope=(), microphone=(), midi=(), payment=(), picture-in-picture=(), publickey-credentials-create=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), usb=(), web-share=(), xr-spatial-tracking=()

iframe allow attribute

Copy-ready output from the selected rules.

<iframe allow="accelerometer 'none'; autoplay 'none'; camera 'none'; clipboard-read 'none'; clipboard-write 'self'; display-capture 'none'; fullscreen 'self'; geolocation 'none'; gyroscope 'none'; microphone 'none'; midi 'none'; payment 'none'; picture-in-picture 'none'; publickey-credentials-create 'none'; publickey-credentials-get 'self'; screen-wake-lock 'none'; serial 'none'; usb 'none'; web-share 'none'; xr-spatial-tracking 'none'"></iframe>

Permissions Policy support and directive names vary by browser. Test critical features in your supported browsers before enforcing a restrictive policy.

What does Permissions-Policy control?

The Permissions-Policy response header lets a document allow or deny selected browser capabilities for itself and embedded frames. Examples include camera, microphone, geolocation, screen capture, payment, USB, serial devices, and passkeys.

Allowlist choices

  • () blocks the feature.
  • * allows every origin.
  • (self) allows the document's own origin.
  • (self "https://embed.example") adds an explicit origin.
  • Omitting a directive leaves its browser-defined default in place.

The iframe allow attribute uses related but different syntax. A parent policy still sets the upper limit: an iframe cannot grant itself a capability that the parent response header blocks.

Start restrictive and test

A restrictive baseline can reduce unnecessary access to powerful APIs, but it can also break legitimate widgets, video calls, payment flows, sign-in, or embedded content. Identify which frames need each feature, use exact HTTPS origins, and test all supported browsers before enforcement.

Compatibility limits

Permissions Policy is still evolving. Directives can be experimental, renamed, or implemented differently between browsers. This builder provides commonly used current names but cannot determine the capabilities used by your application or guarantee browser support.

Review the current MDN Permissions-Policy reference before deployment. Pair the header with the CSP Header Builder, Cache-Control Header Builder, or SRI Hash Generator. All configuration stays in your browser.

Share this utility

Send the tool, not any text or files you entered. Input is never added to the share URL.

Continue the workflow

Website Security Headers Toolkit

Step 3 of 5. Keep the context and finish the related checks.

View full workflow
Next: Set cache behaviorSeparate public static assets from private or personalized responses.Next: Publish a security contactCreate an RFC 9116 file so researchers know how to report a vulnerability.

Keep working

Related Developer Tools

View all developer tools
CSP Header BuilderBuild, parse, and review Content Security Policy headers and server snippets.Cache-Control Header BuilderBuild, parse, and explain HTTP Cache-Control directives with ready-to-use snippets.SRI Hash Generator & VerifierCreate and verify SHA-256, SHA-384, and SHA-512 Subresource Integrity hashes.Website Design SimulatorDesign responsive webpage themes in a wide preview and export reusable CSS tokens.