Permissions-Policy Header Builder

Subresource Isolation

Even if a malicious advertiser or third-party partner embeds an iframe, the browser denies access to cameras, microphones, or payment APIs if the parent policy does not explicitly delegate access.

Anti-Fingerprinting Defense

Disabling device motion sensors, magnetometers, and ambient light sensors mitigates advanced hardware fingerprinting vectors used by profiling bots to track users across incognito sessions.

Behavioral Privacy Protection

Directives like browsing-topics=() prevent advertising algorithms from silently monitoring domain visits to construct commercial behavioral profiles without express consent.

Nginx (Reverse Proxy & Ingress)

Add the directive within your primary http { }, server { }, or route location / { } block. The always parameter ensures the header is attached even during 4xx/5xx HTTP error states:

add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

Apache HTTP Server (.htaccess)

Verify that mod_headers is enabled inside Apache. Place the rule inside your document root .htaccess file or virtual host configuration:

<IfModule mod_headers.c>
    Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
</IfModule>

Caddy Web Server (Caddyfile)

Caddy allows straightforward declarative header definitions directly inside any domain declaration block:

header Permissions-Policy "camera=(), microphone=(), geolocation=()"

Vercel & Next.js Edge Routing

In Next.js App Router applications, declare headers inside next.config.js or define them inside root vercel.json:

// next.config.js
module.exports = {
  async headers() {
    return [{
      source: '/:path*',
      headers: [{
        key: 'Permissions-Policy',
        value: 'camera=(), microphone=(), geolocation=()'
      }]
    }];
  }
};