Matan · Security · Headers

Permissions-Policy

Disables powerful browser APIs (camera, mic, geolocation) you do not use.

Pass condition in our engine: Permissions-Policy or Feature-Policy is present.

1. Problem description

Formerly Feature-Policy. Without it, a third-party iframe may prompt for sensors depending on other headers. Lock down what you do not need.

2. Most common causes

  • Never configured on a static site.
  • A widget needs camera but the policy was copied from a deny-all example (that is a product issue, not this check).

3. How to fix it

  1. Add Permissions-Policy: camera=(), microphone=(), geolocation=() as a start.
  2. Open specific origins only for features you use.

Test this check

We fetch only this URL (plus robots.txt / llms.txt at the domain root when the check needs them). We do not crawl the rest of the site like a full report.

Scoring rules for the full site crawl are documented in methodology. Want every category at once? Generate a free report.

Get your free SEO & GEO report

Enter your URL and receive a full audit with scoring and recommendations. No sign-up required.

Generate a free reportView sample report