What the Permissions-Policy header does
Permissions-Policy, formerly known as Feature-Policy, is a response header that lets a website decide which powerful browser features the page is allowed to use. It covers things like the camera, microphone, geolocation, payment requests, fullscreen, and more. The site declares a policy once, and the browser enforces it for the page and for any content the page embeds in an iframe.
That last part is what makes the header valuable for security. A modern page often pulls in third party scripts and embedded widgets, and any of them can try to call a sensitive browser API. Without a Permissions-Policy, the browser has no instruction to push back, so an embedded analytics script or ad frame can prompt a visitor for their camera or location. With a policy in place, the browser blocks features you have turned off before the request ever reaches the user, no matter who tries to call them.
How to set a Permissions-Policy
A policy is a list of features, each paired with the origins allowed to use it. An empty list disables a feature for everyone, and the keyword self limits it to your own origin. For example, camera=(), microphone=(), geolocation=(self) switches off the camera and microphone entirely and keeps geolocation scoped to your site. The safest approach is to disable every feature you do not actively use, then open up only the ones your pages genuinely need. When you are ready to write the header, the free Permissions Policy generator builds a complete policy you can copy straight into Nginx, Apache, or your app.