Safety
Permissions-Policy vs Device APIs for Marketing Sites
February 6, 2025
Permissions-Policy vs device APIs is a default-deny choice for public HTML. The header (formerly Feature-Policy) tells the browser which powerful APIs this document and its iframes may use. A brochure site should disable camera, microphone, geolocation, and payment unless a specific page needs them. XSS or a third-party script cannot casually turn on the webcam if the policy forbids it. RoastMyOpsec's free header audit grades Permissions-Policy on the primary document. It does not prompt for device access or test exploits.
The practical difference
A permission prompt is a user decision. Permissions-Policy is a site decision that can make the prompt impossible. Feature-Policy was the old name; send Permissions-Policy on modern stacks.
CSP limits what scripts run. Permissions-Policy limits what those scripts may ask the device to do. You want both.
How to choose what to disable
Start from the page's job. Home, blog, and docs: deny camera, microphone, geolocation, payment, USB, and similar. A store checkout may allow payment on that route only. A maps store-locator may allow geolocation on that route only — not site-wide.
| Page type | camera / mic | geolocation | payment | Takeaway |
|---|---|---|---|---|
| Marketing / blog | Off | Off | Off | One edge header covers the costume |
| Store locator | Off | On that path if needed | Off | Do not enable maps APIs on /about |
| Checkout | Off | Off unless required | On that path if you use Payment Request | Scope the header by route |
| Support video widget | Only if the vendor needs it | Off | Off | Prefer the vendor iframe with its own policy |
When an empty policy still fails
No Permissions-Policy header means browser defaults, which are looser than a marketing site needs. Third-party iframes can inherit more than you think unless you set allow= on the iframe and a document policy.
Tag managers that inject widgets are why this belongs next to the tracker guide: fewer scripts, tighter policy.
Common mistakes
The first mistake is enabling geolocation site-wide for one store-finder page.
The second mistake is copying a checkout Permissions-Policy onto the blog.
The third mistake is Feature-Policy only, with no Permissions-Policy, on current Chrome.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- What Permissions-Policy should a public website send first?
- Disable camera, microphone, geolocation, and payment unless a named route needs them. Expand only with a product reason.
- Does Permissions-Policy replace CSP?
- No. CSP constrains script and framing sources. Permissions-Policy constrains device and browser features. Ship both.
- How does RoastMyOpsec grade Permissions-Policy?
- As part of the free header pack on the primary HTML response. Header read only — no device prompts.