KKorrali Web

Security headers › Permissions-Policy

How to add the Permissions-Policy header in Cloudflare

Permissions-Policy turns browser features such as camera, microphone and geolocation on or off for your site and any embedded frames.

Cloudflare configuration (Transform Rules)

Rules > Transform Rules > Modify Response Header
Action: Set static
Header name: Permissions-Policy
Value: camera=(), microphone=(), geolocation=()

Create the rule for your hostname in the Cloudflare dashboard. For HSTS, Cloudflare also has a dedicated setting under SSL/TLS > Edge Certificates. On Cloudflare Pages you can use a _headers file instead.

Before you deploy

Only disable features you do not use. List each feature your site needs with an allowlist such as camera=(self).

Verify it works

curl -sI https://your-site.com | grep -i permissions-policy

Or run a free Korrali Web scan to check this and every other security header at once.

Scan your site free

Other headers in Cloudflare