Permissions-Policy header

Which browser features — camera, microphone, geolocation — this page and anything embedded in it are allowed to use.

• Help center

Modern browsers give pages access to powerful features: camera, microphone, geolocation, payment, USB, fullscreen. Permissions-Policy (formerly Feature-Policy) lists which of them the page and any frames inside it may use at all. A feature disabled by the policy cannot be requested — not by your code, not by an embedded ad, not by a script an attacker managed to inject.

How SiteScan grades it

Any Permissions-Policy header, or the older Feature-Policy, is counted as “Strong”: the header's value depends so much on what the site does that there is no universally “right” list to judge it against. No header is “Missing”. The site does not break without it, but anything embedded in it keeps the right to ask the visitor for these features.

How to set it

Disable everything you do not use:

Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=()

Empty parentheses mean “nobody”. To allow a feature for your own pages only, write geolocation=(self); to allow one embedded partner, add its origin: payment=(self "https://pay.example"). If an embedded map or video player stops working, check which feature it needs and allow just that one. The header joins the others in the security grade.