Permissions-Policy Builder

Build a Permissions-Policy header that constrains the third-party code you did not write.

What you provide

Comma-separated feature names. Everything else in the list is denied outright.

Result

11 features denied, 1 allowed for your own origin

An empty allowlist — the `()` form — denies a feature to your own page and to everything embedded in it. That second part is the reason to set this header at all: it constrains scripts and iframes you did not write and cannot audit, so an advertising frame cannot ask for the camera even if it tries. `(self)` allows your own origin only. Features not named in the header keep the browser default, which for most is "allowed for self", so listing everything you want denied is deliberate rather than redundant. Setting this header cannot break a feature you were not already using — but it will break one you were, which is why it is worth deploying with the report-only cousin first where your stack supports it.

Diagnostic telemetry
Header name
Permissions-Policy
Value
fullscreen=(self), camera=(), microphone=(), geolocation=(), payment=(), usb=(), autoplay=(), display-capture=(), accelerometer=(), gyroscope=(), magnetometer=(), interest-cohort=()
Denied
11
Allowed for self
fullscreen
Applies to embedded framesThis is the point of the header — it constrains third-party code you did not write and cannot audit.
Yes

What this cannot tell you

  • Builds the header. Deploying it is up to your server or CDN configuration, and this page cannot verify it took effect.
  • Features not named keep the browser default, which for most is allowed for your own origin. Listing what you want denied is deliberate rather than redundant.
  • This cannot break a feature you were not using, but it will break one you were. Deploy with the report-only variant first where your stack supports it.
  • Runs entirely in your browser. Nothing is looked up, transmitted or stored.

Take this with you

Permissions-Policy Builder on RunTheTests — free browser-based websec tools, no sign-up.