Permissions-Policy Header Generator
Build a Permissions-Policy header that controls camera, geolocation, payment, and other browser features per origin, with nginx, Apache, and Express presets.
Loading tool...
What is Permissions-Policy Header Generator?
A Permissions-Policy header generator for controlling powerful browser features. Toggle camera, microphone, geolocation, payment, and 20+ other features, choose where each is allowed — nowhere, same origin, everywhere, or a custom origin list — and copy the finished header along with nginx, Apache, and Express.js snippets.
Key Benefits
- Block sensitive APIs by default instead of trusting every embedded iframe
- Grant features only to the origins that actually need them
- Correct structured-field syntax generated for you, no trial and error
- Meets OWASP secure-headers expectations out of the box
- Server snippets for nginx, Apache, and Express in one place
Common Use Cases
- •Lock down camera, microphone, and geolocation on a content site with third-party embeds
- •Allow a video-call or payment iframe while keeping the feature blocked for everyone else
- •Add the header your security scan or pentest report flagged as missing
- •Standardize permissions across staging and production environments
How to Use the Permissions-Policy Header Generator
- Pick your features: Check the browser features you want to control, such as camera, microphone, or geolocation. Use the presets to deny all sensitive features or allow the common ones for the same origin in one click.
- Choose an allowance mode: For each enabled feature, select whether it is denied everywhere, allowed for the same origin only, allowed everywhere, or restricted to a custom list of origins.
- Enter custom origins if needed: In custom mode, type a comma-separated list of origins, for example https://app.example.com, https://cdn.example.com. Only those origins can use the feature.
- Copy the header or server config: Copy the generated Permissions-Policy header, or grab the ready-made nginx add_header, Apache Header always set, or Express.js middleware snippet and deploy it to your server.
Key Features
- 25 policy-ready browser features grouped into media, sensors, device, identity, and UI categories.
- Four allowance modes per feature: deny everywhere, same-origin, allow everywhere, or a custom origin list.
- One-click presets: deny all sensitive features, or self-only for the most common ones.
- Copy-ready outputs for the raw header, nginx add_header, Apache Header always set, and Express middleware.
- Bilingual EN/TH interface, fully offline, nothing leaves your browser.
Frequently Asked Questions
What is the Permissions-Policy header?
Permissions-Policy (formerly Feature-Policy) is an HTTP header that controls which browser features — camera, microphone, geolocation, payment, USB, and more — your page and its embedded iframes are allowed to use. A feature not listed in the header falls back to the browser default, which is usually to allow it.
What is the difference between deny, self, and custom origins?
Deny (feature=()) blocks the feature everywhere including your own page. Self (feature=(self)) allows it only for your own origin. Custom origins (feature=(https://a.com https://b.com)) allow it for your page plus those listed origins. An asterisk (feature=*) allows it everywhere.
Does the Permissions-Policy header affect third-party scripts on my page?
Yes. The policy you set applies to your document and, by default, is inherited by same-origin iframes. Cross-origin iframes need to be explicitly listed in the allowlist to use controlled features, which is exactly how you keep untrusted embeds from requesting the camera or location.
Is Permissions-Policy supported by all browsers?
All modern browsers (Chrome, Edge, Firefox, Safari) support Permissions-Policy or the deprecated Feature-Policy syntax. Browsers that do not recognize a directive simply ignore it, so shipping the header is safe and never breaks your site.
Where do I put the generated header?
Send it as an HTTP response header from your server or CDN. This tool provides copy-ready snippets for nginx (add_header), Apache (Header always set), and Express.js (res.setHeader) so the header is set on every response.