Cloudflare

1 Go to Rules > Transform Rules > Modify Response Header
2 Create a rule that sets Permissions-Policy to the desired value
3 Deploy the rule

Header name: Permissions-Policy
Value: camera=(), microphone=(), geolocation=()

Cloudflare docs

AWS CloudFront

1 Create a Response Headers Policy in CloudFront
2 Attach the policy to your distribution's behavior

Custom header:
  Name: Permissions-Policy
  Value: camera=(), microphone=(), geolocation=()
  Override origin: Yes

AWS CloudFront docs

Vercel

1 Add a headers entry to your vercel.json
2 Redeploy

json

{
  "headers": [
    {
      "source": "/(.*)",
      "headers": [
        { "key": "Permissions-Policy", "value": "camera=(), microphone=(), geolocation=()" }
      ]
    }
  ]
}

Vercel docs

Netlify

1 Add a headers section to your netlify.toml or _headers file
2 Redeploy

toml

[[headers]]
  for = "/*"
  [headers.values]
    Permissions-Policy = "camera=(), microphone=(), geolocation=()"

Netlify docs

Nginx

1 Add the header directive to your server or location block
2 Test config with nginx -t, then reload

nginx

add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

Nginx docs

Apache

1 Make sure mod_headers is enabled
2 Add the Header directive to your .htaccess or VirtualHost

apacheconf

Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"

Apache docs

Next.js

1 Add a headers function to your next.config.js
2 Rebuild and redeploy

javascript

// next.config.js
module.exports = {
  async headers() {
    return [{
      source: "/(.*)",
      headers: [
        { key: "Permissions-Policy", value: "camera=(), microphone=(), geolocation=()" },
      ],
    }];
  },
};

Next.js docs

Express

1 Use the helmet middleware (recommended) or set the header manually
2 Restart your server

javascript

// Using helmet (recommended)
const helmet = require("helmet");
app.use(helmet());

// Or manually
app.use((req, res, next) => {
  res.setHeader("Permissions-Policy", "camera=(), microphone=(), geolocation=()");
  next();
});

Express docs

Django

1 Add or update the setting in your settings.py
2 Redeploy

python

# settings.py
# Django's SecurityMiddleware handles several headers.
# For custom headers, use middleware or django-csp.

Django docs

Laravel

1 Add a middleware that sets the header
2 Register it in your HTTP kernel

php

// app/Http/Middleware/SecurityHeaders.php
public function handle($request, Closure $next)
{
    $response = $next($request);
    $response->headers->set('Permissions-Policy', 'camera=(), microphone=(), geolocation=()');
    return $response;
}

Laravel docs

Rails

1 Set the header in your ApplicationController or config

ruby

# config/application.rb
config.action_dispatch.default_headers.merge!(
  'Permissions-Policy' => 'camera=(), microphone=(), geolocation=()'
)

Rails docs

Spring Boot

1 Configure the header in your SecurityFilterChain

java

@Bean
SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    http.headers(h -> h
        .addHeaderWriter(new StaticHeadersWriter("Permissions-Policy", "camera=(), microphone=(), geolocation=()"))
    );
    return http.build();
}

Spring Boot docs

WordPress

1 Add the header via your theme's functions.php or .htaccess
2 A security plugin like HTTP Headers can also help

php

# .htaccess (Apache)
Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"

# Or in functions.php
add_action('send_headers', function() {
    header('Permissions-Policy: camera=(), microphone=(), geolocation=()');
});

WordPress docs

Nuxt

1 Add the header to your nuxt.config.ts routeRules
2 Rebuild and redeploy

typescript

// nuxt.config.ts
export default defineNuxtConfig({
  routeRules: {
    '/**': {
      headers: { 'Permissions-Policy': 'camera=(), microphone=(), geolocation=()' },
    },
  },
});

Nuxt docs

ASP.NET

1 Add middleware in your Program.cs or Startup.cs

csharp

app.Use(async (context, next) =>
{
    context.Response.Headers.Append("Permissions-Policy", "camera=(), microphone=(), geolocation=()");
    await next();
});

ASP.NET docs

Add a Permissions-Policy header

CDN and edge

Web servers

Frameworks

Cloudflare

AWS CloudFront

Vercel

Netlify

Nginx

Apache

Caddy

Next.js

Express

Django

Laravel

Rails

Spring Boot

WordPress

Nuxt

ASP.NET