Permissions-Policy header

Recommended value

Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=()

How to set Permissions-Policy

# inside your server { } block
add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=()" always;

# .htaccess or virtual host (needs mod_headers)
Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=()"

// app/Http/Middleware/SecurityHeaders.php
public function handle(Request $request, Closure $next): Response
{
    $response = $next($request);
    $response->headers->set('Permissions-Policy', 'camera=(), microphone=(), geolocation=(), payment=(), usb=()');

    return $response;
}

// bootstrap/app.php
->withMiddleware(function (Middleware $middleware) {
    $middleware->append(\App\Http\Middleware\SecurityHeaders::class);
})

app.use((req, res, next) => {
  res.setHeader('Permissions-Policy', 'camera=(), microphone=(), geolocation=(), payment=(), usb=()');
  next();
});

// or: app.use(require('helmet')()) for a sensible default set

Rules → Transform Rules → Modify Response Header → Create rule.
Match: all incoming requests (or your hostname).
Then: Set static → Header name: Permissions-Policy → Value: camera=(), microphone=(), geolocation=(), payment=(), usb=()

In nginx, an add_header inside a location block discards every add_header inherited from the server block. Repeat your security headers there, or use an include file. The always flag also sends the header on error responses.

Common mistakes

• ✕ Using the old Feature-Policy syntax (camera 'none') in a Permissions-Policy header. It does not parse.
• ✕ Leaving origins unquoted, as in geolocation=(self https://maps.example).
• ✕ Disabling a feature your own checkout or video page needs. Allow self on those routes instead.
• ✕ Copying interest-cohort=() from old guides. It was for FLoC, which Chrome dropped.

FAQ