Set a Permissions-Policy

Web headers · about 5 min

In plain words

Lock down powerful browser features (camera, microphone, location, payment) your site doesn’t need, so injected or embedded code can’t ask for them.

What can go wrong

Third-party scripts or an injection could prompt visitors for camera, microphone or location access under your name.

How to fix it

Pick the platform your site runs on. Not sure? Forward this page to whoever manages your website.

Nginx

# inside the server { } block
add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=()" always;

Apache / .htaccess

<IfModule mod_headers.c>
  Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=()"
</IfModule>

Cloudflare

Rules → Transform Rules → Modify Response Header
  Set static: Permissions-Policy = camera=(), microphone=(), geolocation=(), payment=(), usb=()

# Cloudflare Pages: add to public/_headers
/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=()

Vercel

// vercel.json
{ "headers": [ { "source": "/(.*)", "headers": [
  { "key": "Permissions-Policy", "value": "camera=(), microphone=(), geolocation=(), payment=(), usb=()" }
] } ] }

Netlify

# public/_headers
/*
  Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=()

WordPress

// functions.php (child theme) — or use your security plugin's "HTTP headers" setting
add_action('send_headers', function () {
  header('Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=()');
});

Before you change anything: Leave out any feature your site really uses (e.g. remove geolocation=() if you have a store locator).

Check that it worked

Re-run the ProbeHunt check.

Re-run the free check

References

MDN: Permissions-Policy