Skip to content
DomainGrade

What we checkSecurity headersHD-05

Permissions-Policy

Switches off browser features your site never uses, like the camera and microphone.

Area
Security headers
Check
HD-05
Included
Free in every scan

What we check

We read the Permissions-Policy header. This check is informational and never affects your score.

Why it matters

If a script does get onto your page, this limits what it can ask for. A site with no video calls has no reason to leave camera access available to be requested.

It also applies to anything you embed. A third-party iframe inherits the page's permissions unless the policy says otherwise, so a widget you added for one purpose does not quietly gain access to the rest.

A policy names each feature and who may use it. An empty list, camera=(), means nobody — including your own page.

How to fix it

  1. 1

    Send a policy disabling the features you do not use.

  2. 2

    Start from the features you know you use and disable everything else; the list is short for most sites.

  3. 3

    Set it alongside your CSP, at the same place in the stack, so the two do not drift apart.

A response header
Permissions-Policy: camera=(), microphone=(), geolocation=()

Common questions

Why is this informational?
It is defence in depth rather than a gap on its own, and the right policy varies so much by site that grading it would produce more noise than signal.
What replaced Feature-Policy?
This did. The syntax changed — camera=() rather than camera 'none'.
Does it affect my own scripts?
Yes — it applies to the whole page. Only disable what you genuinely do not use.

See how your domain does on this check.

All 34 checks, a grade, and the exact fix for anything that isn’t right — in about twenty seconds, no signup.

Other security headers checks