Security Tools
Permissions-Policy Checker
Check whether a website sends a Permissions-Policy header.
Enter a domain to check whether it sends a Permissions-Policy header.
JustChecker monitors your security headers continuously and alerts you if any regress.
Frequently Asked Questions
It restricts which powerful browser features (camera, microphone, geolocation, and others) a page - and any content embedded within it via iframes - is allowed to access, even if the underlying browser API itself would otherwise permit it.
It's defense-in-depth against a compromised third-party script or a malicious embedded iframe attempting to access a sensitive device feature you never intended to expose in the first place.
It was originally introduced as Feature-Policy - Permissions-Policy is the renamed, refined successor with a similar but not identical syntax, so older documentation referencing Feature-Policy reflects the deprecated predecessor.
It can restrict both - by default it applies to your own page's use of these features as well as any framed/embedded content, though it can be configured to allow specific origins for embedded iframes.
It's a lower-priority header for sites that genuinely never touch camera/microphone/geolocation-style APIs, but it costs nothing to add and closes off any risk from third-party embedded content misusing those features.
Some directives can restrict resource-intensive browser features (background sync, certain autoplay behaviors) that aren't strictly security-related, offering a minor performance/battery-life benefit alongside the security purpose.