Skip to main content
SlapMyWeb
Slap a site

Security fix

How to Add a Permissions-Policy Header

Restrict which browser features (camera, mic, geolocation) the page and its iframes can use.

Difficulty
Easy
Impact
Low
Time
5 min

Before

# No Permissions-Policy header

After

Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
Before and after code for: How to Add a Permissions-Policy Header

A missing Permissions-Policy header means the browser applies no restriction on which powerful features a page and its embedded frames may use: camera, microphone, geolocation and more. Send the header explicitly, disabling everything the page does not need, so a compromised third-party script or iframe cannot request access on your behalf.

How common is this?

Across every site SlapMyWeb has audited, 18.9% set a Permissions-Policy, which leaves 81.1% with no Permissions-Policy header.

18.9%81.1%

Measured from SlapMyWeb audits of live public URLs. The full aggregate is published as a CC-BY-4.0 dataset.

Why it matters

Permissions-Policy lets you explicitly disable powerful browser APIs your site doesn't use: so a compromised script or embedded iframe can't silently access the camera, microphone or location.

How to fix it

  1. Disable what you don't use

    List the features and set them to () (no origins allowed) unless you genuinely need them.

  2. Send the header

    Add it as a site-wide response header.

The code

Beforehttp
# No Permissions-Policy header
Afterhttp
Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()

On your platform

WordPress

Add via a security-headers plugin or .htaccess.

Next.js

Add under headers() in next.config.js.

Sources

Check your site with our free tool

HTTP Header Checker

More fixes

Security

How to Add X-Content-Type-Options: nosniff

Stop browsers from MIME-sniffing responses: a one-line header that closes an XSS vector.

Security

How to Secure Cookies (Secure, HttpOnly, SameSite)

Add the flags that stop cookies being stolen over HTTP, via XSS, or in CSRF attacks.

Security

How to Fix a Missing SSL Certificate

Serve the whole site over HTTPS so browsers stop marking it as not secure.

Fixed that one.
Now find the rest.

A free audit ranks every issue on your site by the score points it costs, and links each one straight to its guide.

Run a free audit
Free foreverNo signupLive scan progress