# How to set a Permissions-Policy

> Permissions-Policy switches off browser features the site does not use — camera, microphone, geolocation — so injected scripts cannot use them either.

Security · HTML version: https://getreport.app/learn/permissions-policy

## Permissions-Policy header

Passing looks like: Permissions-Policy header is set.

**Why it matters.** The header switches off browser features this page never uses, such as camera, microphone or geolocation, so an injected script or a third-party iframe cannot turn them on.

**How to fix it.**

1. Send the header: Permissions-Policy: camera=(), microphone=(), geolocation=() and list any feature you use with (self).

Check your own page: https://getreport.app/