Security Tools

Permissions-Policy Checker

Check which browser features a site allows itself and embedded content to use.

Not sure what to enter? Try an example: github.com

Free & instant No signup How to use FAQ

Enter a URL to see whether it sends a Permissions-Policy header and which features, such as camera or geolocation, it allows or blocks.

What is a Permissions-Policy?

The Permissions-Policy header (formerly Feature-Policy) lets a site switch browser features on or off - camera, microphone, geolocation, payment and more - for itself and for any embedded content. Disabling features you do not use limits what a compromised script or third-party frame can do.

How to check a website's Permissions-Policy

Enter the domain in the box above.
Click Check Permissions-Policy.
Review which features are allowed and for which origins.
Disable features the site does not need, for example camera=(), microphone=(), geolocation=().

Related checks

To check the Referrer-Policy, use the Referrer-Policy Checker.
For all security headers at once, use the Security Headers Checker.

Turn off browser features your site never uses, such as camera, microphone or geolocation, so injected scripts cannot ask for them. JustChecker watches the header so a later configuration change does not undo it.

Frequently Asked Questions

If an embedded ad, widget or injected script tries to use the camera, microphone or location, the browser blocks it. Turning off what you don't need closes that door.

For most sites: camera=(), microphone=(), geolocation=(), payment=() - then allow only what your pages really use, such as geolocation=(self) for a store locator.

Feature-Policy was the older name. Use Permissions-Policy, which current browsers support.

Share this tool:

Need a website for your business? Only $599