Quick answer: The autoplay directive controls whether a document or embedded frame may automatically play media without a user gesture, affecting the autoplay attribute and play() calls on HTMLMediaElement. Disallow it with the response header Permissions-Policy: autoplay=(). Allow only your own origin with Permissions-Policy: autoplay=(self). Blocked autoplay attempts are rejected.
antipattern

autoplay

The autoplay feature controls access to autoplay of media requested through the HTMLMediaElement interface.

If disabled in a document, then calls to play() without a user gesture will reject the promise with a NotAllowedError DOMException object as its parameter. The autoplay attribute will be ignored.

How to apply this policy

Send the following HTTP header to control the autoplay policy, and disallow it on all origins:

Feature-Policy: autoplay 'none'

Does it work?

Currently Firefox, and Chromium based browsers, such as Google Chrome, Samsung Internet, and Opera, are the only user-agents to support Feature Policy. The minimum version that correctly recognises the autoplay policy is:

Mozilla Firefox

Not supported

Google Chrome

Not supported

Microsoft Edge

Not supported

Apple Safari

Not supported

Discussion