Skip to content

How to set a Permissions-Policy

Security1 min readFixes check permissions-policy

Permissions-Policy switches off browser features the site does not use — camera, microphone, geolocation — so injected scripts cannot use them either.

Step by step, with screenshots: Permissions-Policy: turning off camera, microphone and friends →

Check your own site

Runs this check and the other 186, free, in about 45 seconds.

What a passing site looks like

  • Permissions-Policy header is setwarning · −1 ptseffort S

Permissions-Policy header is missing

Why it matters. The header switches off browser features this page never uses, such as camera, microphone or geolocation, so an injected script or a third-party iframe cannot turn them on.

How to fix it.
  1. Send the header: Permissions-Policy: camera=(), microphone=(), geolocation=() and list any feature you use with (self).

In a report the technical detail reads: Response headers contained no permissions-policy.

Filed under Security. Copy is generated from the same catalogue that scores every report, so what you read here is what the report says.