How to Add a Permissions-Policy Header
Restrict which browser features (camera, mic, geolocation) the page and its iframes can use.
A missing Permissions-Policy header means the browser applies no restriction on which powerful features a page and its embedded frames may use — camera, microphone, geolocation and more. Send the header explicitly, disabling everything the page does not need, so a compromised third-party script or iframe cannot request access on your behalf.
Across every site SlapMyWeb has audited, 18.9% set a Permissions-Policy — which leaves 81.1% with no Permissions-Policy header.
Measured from SlapMyWeb audits of live public URLs. The full aggregate is published as a CC-BY-4.0 dataset.
Why It Matters
Permissions-Policy lets you explicitly disable powerful browser APIs your site doesn't use — so a compromised script or embedded iframe can't silently access the camera, microphone or location.
How to Fix
Disable what you don't use
() (no origins allowed) unless you genuinely need them.Send the header
Code Fix
http# No Permissions-Policy headerPermissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()Platform-Specific Instructions
Add via a security-headers plugin or .htaccess.
Add under headers() in next.config.js.
Fixed that one.
Now find the rest.
A free audit ranks every issue on your site by the score points it costs — and links each one straight to its guide.
Run a free audit