Missing Permissions-Policy Header

What this finding means

Your site does not send a Permissions-Policy header. Without it, every powerful browser API — camera, microphone, geolocation, USB, payment, and dozens more — stays available to your page and any embedded third-party content by default, rather than being explicitly switched off where it isn't needed.

Why it matters

Most pages never need camera, microphone or geolocation access. Explicitly disabling APIs a page doesn't use removes them as an attack surface: a compromised third-party script or a malicious ad embedded in an iframe can't invoke a permission prompt for a capability the top-level page has already switched off. It's defense-in-depth rather than a fix for a specific vulnerability class, which is why it's a lower-severity finding.

What Nivaronix checks

Nivaronix's security headers checker inspects the response headers your site sends and reports whether Permissions-Policy is present. This is a security misconfiguration check based on the header's presence and configuration — not a vulnerability scan, exploit attempt, or penetration test.

Evidence example

Example only, for illustration — not evidence from a live scan of any specific site.

HTTP/1.1 200 OK
(no Permissions-Policy header present)

How to fix it

add_header Permissions-Policy "geolocation=(), camera=(), microphone=(), payment=()" always;

Header always set Permissions-Policy "geolocation=(), camera=(), microphone=(), payment=()"

Rules → Transform Rules → Modify Response Header → set `Permissions-Policy` to your directive list.

Verify the fix

Re-run a scan on your domain, or check manually with curl -sI https://your-domain.example, and confirm Permissions-Policy now appears in the response with the expected value.

Standards reference

MDN — Permissions-Policy. See the methodology page for exactly how this finding is scored.