Permissions-Policy: switch off browser features your site does not use

Test your website free

Runs all 69 checks, including this one. 5 free audits a day.

Browsers can give websites access to the camera, microphone, location and other features. The Permissions-Policy header lets you say up front which of these your site never uses, so no script on your pages, including third-party ones, can ask for them.

In our November 2026 study of businesses selling to AI agents, 72% of the 1,190 websites we checked sent no Permissions-Policy header. See the full study.

Why it matters

It is a simple way to reduce what a compromised plugin or advert could do, and it shows visitors and security tools that the site is looked after.

What our check looks for

Pass: Permissions-Policy present
Fail: Missing

Check ID security.permissions_policy.present · Security · Low priority

How to fix it

A sensible starting header

Permissions-Policy: camera=(), microphone=(), geolocation=(), usb=(), interest-cohort=()

The empty brackets mean "no one, not even this site". Leave out any feature your site really uses.

Apache or cPanel (.htaccess)

<IfModule mod_headers.c>
  Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(), usb=()"
</IfModule>

Add it next to your other security headers.

Nginx

add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), usb=()" always;

Put it in the server block for your site.

Cloudflare

Rules > Transform Rules > Modify response header

Add a header called Permissions-Policy with the value above.

Common mistakes

Turning off payment=() on a page with Apple Pay or Google Pay buttons, which stops them working.
Turning off geolocation on a store finder or a "near me" page that needs it.
Using the old Feature-Policy header name, which modern browsers no longer read.

Related checks

Written by Derek Moore, who builds and runs websites for small UK businesses. Last checked 30 October 2026.