Permissions Policy
Controls whether a document and its embedded frames may use selected browser capabilities.
CC—01 / BROWSER SUPPORTBundled data · No network lookupsBCD 8.1.5
Find the break.
Browser security doesn’t arrive everywhere at once. Choose a protection. See where support stops.
Showing Permissions Policy.
Current release channels in the bundled source. For older browsers, set your own minimums
Support data, not a security score. A browser result does not certify a site or prove runtime enforcement.
Full support tableContent Security Policy
Restricts the browser resources and execution paths that a document may use.
CSP nonce sources
Authorises selected inline scripts with unpredictable, response-specific nonce values.
CSP hash sources
Authorises exact inline script or style content through cryptographic source expressions.
CSP strict-dynamic
Allows trust from a nonce- or hash-authorised script to propagate to scripts it loads.
CSP base-uri restriction
Restricts which URLs a document may use as its base URL.
CSP frame-ancestors restriction
Restricts which parent documents may embed a page in a frame.
CSP form-action restriction
Restricts the destinations to which a document may submit forms.
CSP upgrade-insecure-requests
Asks the browser to rewrite eligible insecure resource requests to HTTPS.
CSP sandbox
Applies a configurable sandbox to a protected resource.
Trusted Types enforcement
Restricts selected DOM injection sinks to values created through approved policies.
Subresource Integrity
Lets a document require external scripts and stylesheets to match expected digests.
Subresource Integrity Policy
Requires selected script and style requests to carry integrity metadata, with an optional report-only rollout mode.
Cross-Origin-Opener-Policy
Controls whether a document shares a browsing context group with cross-origin documents.
Cross-Origin-Embedder-Policy
Requires embedded cross-origin resources to opt in through CORS or resource policy.
Cross-Origin-Resource-Policy
Lets a resource state which origins or sites may embed it without CORS.
Credentialless cross-origin embedding
Allows selected cross-origin no-CORS resources to load without credentials under COEP.
Origin-Agent-Cluster
Requests origin-keyed browser agent clustering for a document.
Fetch Metadata request headers
Supplies request context that servers can use in a resource-isolation policy.
Permissions Policy
Controls whether a document and its embedded frames may use selected browser capabilities.
HTTP Strict Transport Security
Tells supporting browsers to use HTTPS for a host during a declared period.
X-Content-Type-Options nosniff
Prevents selected responses from being interpreted as a different MIME type.
Clear-Site-Data
Requests removal of selected browser-held data for an origin.
Referrer Policy
Limits referrer information sent with navigations and subresource requests.
SameSite cookies
Restricts when cookies are attached to cross-site requests.
Partitioned cookies
Stores selected cross-site cookies in a partition keyed by the top-level site.
HttpOnly cookies
Prevents browser scripts from reading a cookie through ordinary cookie APIs.
Secure cookie prefixes
Applies browser-enforced naming constraints to __Secure-, __Host-, __Http-, and __Host-Http- cookies.
WebAuthn platform authenticator detection
Detects whether a user-verifying platform authenticator is available.
WebAuthn PRF extension
Derives scoped pseudorandom outputs from a compatible WebAuthn credential.
WebAuthn conditional mediation
Allows passkey suggestions to participate in a credential input flow without an immediate modal prompt.
Permissions Policy: camera
Controls whether this document and its frames may use camera.
Permissions Policy: microphone
Controls whether this document and its frames may use microphone.
Permissions Policy: geolocation
Controls whether this document and its frames may use geolocation.
Clear-Site-Data: cache
Requests clearing of browser-held cache in the scope of the response.
Clear-Site-Data: cookies
Requests clearing of browser-held cookies in the scope of the response.
Clear-Site-Data: storage
Requests clearing of browser-held storage in the scope of the response.
Browser compatibility, supplied evidence and runtime behaviour answer different questions. ControlCurrent keeps them separate. Read the limits of each check.
No accounts. No visitor tracking.
No website scans or evidence uploads.