Permissions-Policy Header: The Complete Configuration Guide

Permissions-Policy: camera=(), microphone=(), geolocation=()

# Nginx — both headers for compatibility
add_header Feature-Policy "camera 'none'; microphone 'none'; geolocation 'none'" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

Permissions-Policy: <feature>=<allowlist>

Permissions-Policy: camera=(), microphone=(), geolocation=(self), payment=(self "https://stripe.com")

camera=()                  # Webcam access
microphone=()              # Microphone access
geolocation=()             # Location access
midi=()                    # MIDI device access
usb=()                     # USB device access
bluetooth=()               # Bluetooth access
serial=()                  # Serial port access
hid=()                     # Human Interface Devices
magnetometer=()            # Magnetometer sensor
gyroscope=()               # Gyroscope sensor
accelerometer=()           # Accelerometer sensor

payment=(self)             # Payment Request API — enable for e-commerce
fullscreen=(self)          # Fullscreen API — enable for media players
picture-in-picture=(self)  # PiP — enable for video content
autoplay=(self)            # Media autoplay — enable for video sites
display-capture=()         # Screen capture — usually disable

attribution-reporting=()   # Conversion tracking
browsing-topics=()         # Topics API (Privacy Sandbox)
interest-cohort=()         # FLoC (deprecated but still worth blocking)

server {
    listen 443 ssl http2;
    server_name example.com;

    # Permissions-Policy — block unused browser features
    add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), midi=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=(), payment=(), autoplay=(self), fullscreen=(self)" always;

    # ... rest of your config
}

# In httpd.conf, .htaccess, or VirtualHost block
Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(), midi=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=(), payment=(), autoplay=(self), fullscreen=(self)"

a2enmod headers
systemctl restart apache2

const nextConfig = {
  async headers() {
    return [
      {
        source: '/(.*)',
        headers: [
          {
            key: 'Permissions-Policy',
            value: 'camera=(), microphone=(), geolocation=(), midi=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()',
          },
        ],
      },
    ];
  },
};

module.exports = nextConfig;

{
  "headers": [
    {
      "source": "/(.*)",
      "headers": [
        {
          "key": "Permissions-Policy",
          "value": "camera=(), microphone=(), geolocation=(), midi=(), usb=()"
        }
      ]
    }
  ]
}

// Check if a feature is allowed
navigator.permissions.query({ name: 'camera' }).then(result => {
  console.log('Camera permission:', result.state);
  // "denied" if Permissions-Policy blocks it
});

curl -s -D - -o /dev/null https://example.com | grep -i permissions-policy

Permissions-Policy: camera=(), microphone=(), geolocation=(), midi=(), usb=(), payment=(), autoplay=(), fullscreen=(self)

Permissions-Policy: camera=(), microphone=(), geolocation=(self), midi=(), usb=(), payment=(self "https://js.stripe.com"), autoplay=(), fullscreen=(self)

Permissions-Policy: camera=(self), microphone=(self), geolocation=(), midi=(), usb=(), payment=(self), autoplay=(self), fullscreen=(self), picture-in-picture=(self)

Permissions-Policy: camera=(), microphone=(), geolocation=(), midi=(), usb=(), payment=(self), autoplay=(), fullscreen=(self), clipboard-write=(self)