Free Tools

Permissions Policy Builder

Your Permissions-Policy header

Nothing set yet - every feature below is falling back to its own default. Start from one of these, import an existing policy, or set features yourself below.

18 directives

Camera, microphone, screen capture, location, motion sensors, USB, serial, Bluetooth, HID, MIDI, gamepads, XR, idle detection, local fonts and screen wake lock.

27 directives

The same list, plus Topics, Protected Audience, Shared Storage, Private Aggregation, Private State Tokens and Attribution Reporting - all of which are open to every frame you embed until a policy says otherwise.

Features

A feature you haven't set isn't unprotected - it falls back to the default shown against it. Setting one only matters where you want something other than that.

This header sets the ceiling for embedded frames as well as the page. An iframe's allow attribute can only narrow what this header permits - it can never grant a feature the header denies. It works the other way too: naming an origin here is necessary but not sufficient, because a cross-origin frame also needs allow on the <iframe> itself before it gets the feature.

These fall back to * rather than self, so leaving them alone is not the same as leaving them closed - any frame you embed can use them until your policy says otherwise. Denying one restricts your own pages as well as embedded frames, so deny the features you don't use rather than all of them by reflex.

gamepad
Access to gamepads and other game controllers.
Falls back to *
Proposed Proposed for the registry, and shipping in Chromium-based browsers.
picture-in-picture
Use of the Picture-in-Picture API.
Falls back to *
storage-access
Use of the Storage Access API to request unpartitioned cookie access.
Falls back to *
sync-xhr
Whether synchronous XMLHttpRequest is permitted. The API it governs is deprecated, which is a reason to deny it.
Falls back to *
unload
Whether unload event handlers may run. Denying it keeps pages eligible for the back/forward cache.
Falls back to *
Experimental Experimental, and shipping in Chromium-based browsers.
browsing-topics
Use of the Topics API to observe or supply advertising topics.
Falls back to *
Experimental Experimental, and shipping in Chromium-based browsers.
join-ad-interest-group
Joining a Protected Audience interest group for ad targeting.
Falls back to *
Experimental Experimental, and shipping in Chromium-based browsers.
run-ad-auction
Running a Protected Audience on-device ad auction.
Falls back to *
Experimental Experimental, and shipping in Chromium-based browsers.
shared-storage
Access to the Shared Storage API, which holds cross-site data for advertising use.
Falls back to *
Not registered Not in the W3C registry, but Chromium-based browsers still act on it.
shared-storage-select-url
Choosing a URL to render based on cross-site data held in Shared Storage.
Falls back to *
Not registered Not in the W3C registry, but Chromium-based browsers still act on it.
private-aggregation
Sending aggregated cross-site measurement reports.
Falls back to *
Not registered Not in the W3C registry, but Chromium-based browsers still act on it.
private-state-token-issuance
Issuing Private State Tokens, which carry trust signals between sites.
Falls back to *
Not registered Not in the W3C registry, but Chromium-based browsers still act on it.
private-state-token-redemption
Redeeming Private State Tokens issued by another site.
Falls back to *
Not registered Not in the W3C registry, but Chromium-based browsers still act on it.
attribution-reporting
Use of the Attribution Reporting API to measure ad conversions.
Falls back to *

Every feature here already falls back to self - your own origin only. Setting one matters where you want something other than that.

Camera, microphone and screen
autoplay
Automatic playback of audio or video without a user gesture.
Falls back to self
camera
Access to video capture devices.
Falls back to self
display-capture
Access to screen, window, or tab capture.
Falls back to self
encrypted-media
Use of the Encrypted Media Extensions API for protected content.
Falls back to self
fullscreen
Use of the Fullscreen API.
Falls back to self
microphone
Access to audio capture devices.
Falls back to self
Location and sensors
accelerometer
Access to accelerometer sensor readings.
Falls back to self
compute-pressure
Access to the Compute Pressure API.
Falls back to self
geolocation
Access to the device's location.
Falls back to self
gyroscope
Access to gyroscope sensor readings.
Falls back to self
magnetometer
Access to magnetometer sensor readings.
Falls back to self
xr-spatial-tracking
Access to WebXR spatial tracking sensors.
Falls back to self
Connected devices
bluetooth
Access to the Web Bluetooth API.
Falls back to self
hid
Access to the WebHID API for human interface devices.
Falls back to self
midi
Use of the Web MIDI API.
Falls back to self
serial
Access to the Web Serial API.
Falls back to self
usb
Access to the WebUSB API.
Falls back to self
Identity and payment
identity-credentials-get
Retrieval of federated identity credentials via the Credential Management API.
Falls back to self
otp-credentials
Retrieval of one-time passwords via the WebOTP API.
Falls back to self
payment
Use of the Payment Request API.
Falls back to self
publickey-credentials-create
Use of WebAuthn's credential creation (registration) ceremony.
Falls back to self
Not registered Not in the W3C registry, but Chromium-based browsers still act on it.
publickey-credentials-get
Use of WebAuthn's credential retrieval (assertion) ceremony.
Falls back to self
Page behaviour
clipboard-read
Reading the contents of the system clipboard.
Falls back to self
Proposed Proposed for the registry, and shipping in Chromium-based browsers.
clipboard-write
Writing to the system clipboard.
Falls back to self
Proposed Proposed for the registry, and shipping in Chromium-based browsers.
cross-origin-isolated
Whether a document may use APIs gated behind cross-origin isolation.
Falls back to self
idle-detection
Use of the Idle Detection API to observe user idleness.
Falls back to self
local-fonts
Access to the local fonts installed on the device.
Falls back to self
Experimental Experimental, and shipping in Chromium-based browsers.
screen-wake-lock
Use of the Screen Wake Lock API.
Falls back to self
web-share
Use of the Web Share API to invoke the platform share dialog.
Falls back to self
window-management
Placement of windows across multiple screens.
Falls back to self

Built a policy? See exactly what's being permitted, continuously.

Report URI can collect Permissions-Policy violation reports as your policy runs in production, so you find out the moment something is blocked unexpectedly - not the next time you happen to check.

Start Free Trial Learn More