Free Tools

Permissions Policy Builder

Your Permissions-Policy header

Nothing set yet - every feature below is falling back to its own default. Set one or more features, or import an existing policy, to build a header.

Features

A feature you haven't set isn't unprotected - it falls back to the default shown against it. Setting one only matters where you want something other than that.

This header sets the ceiling for embedded frames as well as the page. An iframe's allow attribute can only narrow what this header permits - it can never grant a feature the header denies. It works the other way too: naming an origin here is necessary but not sufficient, because a cross-origin frame also needs allow on the <iframe> itself before it gets the feature.

accelerometer
Access to accelerometer sensor readings.
Falls back to self
ambient-light-sensor
Access to ambient light sensor readings.
Falls back to self
autoplay
Automatic playback of audio or video without a user gesture.
Falls back to self
battery
Access to the Battery Status API.
Falls back to self
camera
Access to video capture devices.
Falls back to self
display-capture
Access to screen, window, or tab capture.
Falls back to self
encrypted-media
Use of the Encrypted Media Extensions API for protected content.
Falls back to self
execution-while-not-rendered
Whether a document may keep executing scripts while it is not being rendered.
Falls back to self
execution-while-out-of-viewport
Whether a document may keep executing scripts while it is out of the viewport.
Falls back to self
fullscreen
Use of the Fullscreen API.
Falls back to self
geolocation
Access to the device's location.
Falls back to self
gyroscope
Access to gyroscope sensor readings.
Falls back to self
magnetometer
Access to magnetometer sensor readings.
Falls back to self
microphone
Access to audio capture devices.
Falls back to self
midi
Use of the Web MIDI API.
Falls back to self
payment
Use of the Payment Request API.
Falls back to self
picture-in-picture
Use of the Picture-in-Picture API.
Falls back to self
publickey-credentials-get
Use of WebAuthn's credential retrieval (assertion) ceremony.
Falls back to self
screen-wake-lock
Use of the Screen Wake Lock API.
Falls back to self
sync-xhr
Whether synchronous XMLHttpRequest is permitted (deprecated).
Falls back to *
usb
Access to the WebUSB API.
Falls back to self
xr-spatial-tracking
Access to WebXR spatial tracking sensors.
Falls back to self

Built a policy? See exactly what's being permitted, continuously.

Report URI can collect Permissions-Policy violation reports as your policy runs in production, so you find out the moment something is blocked unexpectedly - not the next time you happen to check.

Start Free Trial Learn More