How to set a Permissions-Policy
Permissions-Policy switches off browser features the site does not use (camera, microphone, geolocation) so injected scripts cannot use them either.
Step by step, with screenshots: strict-origin-when-cross-origin: Referrer-Policy and Permissions-Policy →
Check your own site
Runs this check and the other 192, free, in about 45 seconds.
Or run only this check with the free Security headers checker.
What it is
Permissions-Policy is a response header that tells the browser which powerful features your page and the frames inside it may use, such as camera, microphone, geolocation, payment and fullscreen. A feature you switch off cannot be turned on by your own scripts, injected scripts or embedded third-party iframes.
It replaced the older Feature-Policy header and is written as a list, for example Permissions-Policy: camera=(), microphone=(), geolocation=(), where empty brackets mean nobody may use the feature. getReport flags pages that send no Permissions-Policy. A page is OK when the header turns off every sensitive feature the site does not use and allows the ones it does use only for itself or named partners.
What a passing site looks like
- Permissions-Policy header is setwarning · −1 ptseffort S
Permissions-Policy header is missing
Why it matters. The header switches off browser features this page never uses, such as camera, microphone or geolocation, so an injected script or a third-party iframe cannot turn them on.
- Send the header: Permissions-Policy: camera=(), microphone=(), geolocation=() and list any feature you use with (self).
In a report the technical detail reads: Response headers contained no permissions-policy.
Questions people ask
What does "Permissions policy violation: unload is not allowed in this document" mean?
It is a Chrome console message: the page, or a script on it, tried to add an unload event listener, which Chrome is phasing out because unload handlers are unreliable and stop the back/forward cache from working. It is usually harmless but shows that some code relies on unload. Replace it with pagehide or visibilitychange, or update the plugin or script that adds it.
What should a Permissions-Policy header contain?
List the sensitive features and allow only what you use. A typical content or shop site can send Permissions-Policy: camera=(), microphone=(), geolocation=(), usb=(), payment=(self), fullscreen=(self). Use (self) for features your own pages use, and add a partner's origin in quotes, such as payment=(self "https://pay.example"), for an embedded provider. Unknown feature names are ignored.
How do I add a Permissions-Policy header in WordPress?
Add it in the web server, CDN or your host's header settings, which also covers files outside WordPress. On Apache or LiteSpeed hosting, a Header always set Permissions-Policy line in .htaccess works, and several security and header plugins provide a form for it. Afterwards, test pages with maps, video embeds, checkout and contact forms to confirm nothing you use was switched off.