---
title: "Add Feature-Policy in Drupal 8 with the Security Kit Module"
description: "The Feature-Policy HTTP header specifies what browser features can be used on a website and its <iframe> elements. The most common browser features among a long list are autoplay (for videos),..."
url: https://www.inmotionhosting.com/support/edu/drupal/feature-policy-drupal-8-security-kit/
date: 2019-12-17
modified: 2023-09-13
author: "InMotion Hosting Contributor"
categories: ["Drupal"]
type: post
lang: en
---

# Add Feature-Policy in Drupal 8 with the Security Kit Module

The Feature-Policy HTTP header specifies what browser features can be used on a website and its `<iframe>` elements. The most common browser features among a long list are autoplay (for videos), camera, fullscreen, and microphone.

Below we’ll cover how to install the [Security Kit module](#install) in Drupal 8 and enable [Feature Policy](#feature).

Get high performance and security with our [Managed Drupal Hosting](https://www.inmotionhosting.com/drupal-hosting).

## Install Security Kit

1. [Login to Drupal](https://www.inmotionhosting.com/support/edu/drupal/how-to-log-into-the-drupal-admin-dashboard/).
2. [Install the Drupal module](https://www.inmotionhosting.com/support/edu/drupal/install-2/#admin) using the [Security Kit download link](https://www.drupal.org/project/seckit).
3. Click **Install** at the bottom.

## Enable Feature Policy

1. Click **Configuration** at the top.
2. Under *System*, Click **Security Kit settings**.
3. At the bottom, click **Feature Policy** to expand its settings.
4. Check the box beside **Feature policy**.
5. Add any [directives and their allowlist](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-Policy#Directives) options:`*` – allowed`'self'` – allowed only from same website`'none'` – disabled[specified-domain(s)]For example, to disable autoplay, camera, geolocation, microphone, and MIDI, but enable audio from all internal and embedded iframes on your website:`"autoplay 'none'; camera 'none'; geolocation 'none'; microphone 'none'; midi *; speaker 'self' https://example2.com;"`
6. Click **Save configuration**.

![](https://www.inmotionhosting.com/support/wp-content/uploads/2019/12/drupal-security-kit-feature-policy-1024x272.png)

Test your results at [SecurityHeaders.com](https://securityheaders.com). If you want more security, add [Content-Security-Policy (CSP)](https://www.inmotionhosting.com/support/edu/drupal/content-security-policy-csp-drupal-8/) and [HTTP Strict Transport Security (HSTS)](https://www.inmotionhosting.com/support/edu/drupal/hsts-drupal-8-security-kit/) to your websites. Then, when someone asks “what is Drupal?”, you can simply reply “secure”.