Permissions-Policy Header Generator
Build a Permissions-Policy header controlling camera, geolocation and more.
Features
Generated header
About the Permissions-Policy Header Generator
Toggle each browser feature between blocked, self-only, allow-all or a custom origin list to build a valid Permissions-Policy header, plus a ready Nginx snippet.
Examples
Example
camera blocked, geolocation selfOutput
Permissions-Policy: camera=(), geolocation=(self)Keyboard shortcuts
- Copy the main outputCtrl / ⌘ + Shift + C
- Download the resultCtrl / ⌘ + S
- Share this toolCtrl / ⌘ + Shift + S
- Reset the inputsAlt + R
- Open the tool search paletteCtrl / ⌘ + K
Related tools
Security Headers Auditor
Security
Grade HTTP response headers against security best practices.
CORS Config Generator
Security
Generate CORS headers/config for Nginx, Apache, Express, or Workers.
CSP Builder
Security
Build a Content-Security-Policy header from per-directive sources.
Referrer Policy Generator
Security
Pick a Referrer-Policy value and get header/meta/server snippets.
Robots.txt Security Checker
Security
Scan robots.txt for accidental disclosure of sensitive paths.
X-Frame-Options / Clickjacking Checker
Security
Check if X-Frame-Options and CSP frame-ancestors block framing.
Frequently asked questions
Read more
- Content Security Policy from scratch
CSP is one of the most effective defenses against XSS, and one of the easiest to get wrong. Here's how to build a policy that actually works.
- Understanding CORS errors and how to fix them
Why 'No Access-Control-Allow-Origin header' shows up, what the browser is actually enforcing, and the exact headers that fix each case.
Comments
No login needed. Comments appear after a quick review.
Loading comments…
Version 1.0.0 · Updated 2026-08-09 · Runs entirely in your browser