Your files stay on your device

Permissions policy generator

Pick a feature, choose who may use it, and get a correct Permissions-Policy header value to copy into your server config.

Add a directive to build the header value.

The value is re-checked against the same grammar the checker grades while it is built, so a malformed origin is refused here instead of failing in your server config. Deploying a directive replaces the browser's default allowlist for that feature, and every frame you did not name is denied, subdomains of your own included. The registry is frozen at 2026-11; features shipped after that are not in the list.

Add a directive

Feature56 names in the frozen registry

Who may use it

Include self

Origins, one per lineUp to 32, scheme plus host only

More settings

At most 64 directives, and each feature once: browsers keep the last directive for a feature and silently drop earlier ones.

CSP evaluator & builder
Deep probes

All web & auth tools

Was this tool useful?

Permissions policy generator

More web & auth tools