Permissions-Policy
Lets you switch off powerful browser features, camera, microphone, geolocation, for your pages and any content they embed.
What it does
Permissions-Policy (the successor to the older Feature-Policy header) declares which browser APIs your page, and anything it embeds via iframe, is allowed to use. Features are disabled by default once you list them, closing off capabilities you never intended to grant.
Why it matters
Modern browsers expose powerful APIs, camera, microphone, geolocation, USB, autoplay, that most pages never need. If a third-party script gets compromised (a common supply-chain attack vector for ad tech and analytics snippets), a restrictive Permissions-Policy limits what it can actually do, even if it manages to run.
Recommended value
An empty () means "allowed nowhere, not even your own origin." Start by disabling anything your application doesn't explicitly use, then loosen individual features only as needed, for example geolocation=(self) if your own pages use it but embeds shouldn't.