https://csp-guide.com/tags/permissions-policy/ Recent content in Permissions-Policy on CSP Guide Hugo -- gohugo.io en-us Thu, 30 Jul 2026 00:00:00 +0000 https://csp-guide.com/posts/csp-and-the-permissions-policy-header-working-together/ Thu, 30 Jul 2026 00:00:00 +0000 https://csp-guide.com/posts/csp-and-the-permissions-policy-header-working-together/ <p>Content Security Policy and Permissions-Policy solve different problems, and that’s exactly why they work well together.</p> <p>I’ve seen teams treat security headers like a checklist: add CSP, maybe HSTS, call it done. That misses a lot. CSP controls <strong>what the page can load and execute</strong>. Permissions-Policy controls <strong>which browser features the page and its iframes can use</strong>. One limits code and resource behavior. The other limits capability.</p> <p>If you care about reducing browser-side attack surface, you want both.</p>