Free Permissions Policy Checker

Inspect the Permissions-Policy response header on any public website. Review which browser features are restricted, allowed or not explicitly controlled.

DeployPass reads the public response header only. A missing policy is a hardening opportunity, not proof of a vulnerability.

UNDERSTAND THE RESULT

Control access to powerful browser features.

Permissions-Policy lets a site limit access to browser capabilities such as camera, microphone, geolocation, payment and fullscreen. The right policy depends on the application: a marketing site may deny most powerful features, while a video or mapping app may intentionally allow a small set.

camera & microphone

Restrict media capture when the page and its embedded frames do not need it.

camera=(), microphone=()

geolocation

Limit location access to the origins that genuinely require it.

geolocation=(self)

payment

Control whether the Payment Request API can be used by the page or embedded content.

payment=(self)

fullscreen

Fullscreen may be intentional for media apps, so evaluate it in application context.

fullscreen=(self)

INTERPRET CAREFULLY

A missing Permissions-Policy is not automatically a vulnerability.

This header is a browser capability-control and defense-in-depth mechanism. DeployPass highlights broad or missing controls as review points, but does not assume every application needs the same directive list. Apply least privilege without breaking features your site intentionally uses.

FAQ

Permissions Policy checker FAQ

What is Permissions-Policy?

It is an HTTP response header that controls whether a document and its embedded frames may use selected browser features.

Is Permissions-Policy the same as Feature-Policy?

Permissions-Policy is the newer mechanism that replaced the older Feature-Policy header and uses different syntax.

Does every website need the same policy?

No. The safest policy is application-specific. Deny features you do not use and scope required capabilities as narrowly as practical.

Does a high score prove my website is secure?

No. This focused checker reviews one public response header. Use the full DeployPass scan for broader public-surface checks and deeper testing for application security.