Skip to content

Permissions-Policy Header

Lets you switch off or restrict powerful browser APIs — camera, microphone, geolocation and more — for your own pages and any embedded content.

Last updated August 9, 2026.

Severity when missing: Low — see how Nivaronix reports this on the security headers checker.

Check if your site sends this header

What it does

Permissions-Policy (the successor to Feature-Policy) declares, per browser API, which origins may use it. Each directive names a feature — `geolocation`, `camera`, `microphone`, `payment`, `usb`, `fullscreen`, and dozens more — and an allow-list of origins, where `()` means nobody, including the page itself, can use that feature.

Why it matters

Most pages never need camera, microphone or geolocation access. Explicitly disabling APIs a page doesn't use removes them as an attack surface: a compromised third-party script or a malicious ad embedded in an iframe can't invoke a permission prompt for a capability the top-level page has already switched off. It's defense-in-depth rather than a fix for a specific vulnerability class, which is why it's a lower-severity finding.

Example header

Example only — this is not evidence from a live scan.

Permissions-Policy: geolocation=(), camera=(), microphone=()

How to test for it

  • Run `curl -sI https://example.com` and check for a `Permissions-Policy` header.
  • Review the directive list against what the page actually needs — a video-conferencing page legitimately needs `camera` and `microphone`; most marketing and content pages need neither.

How to add it

Nginx

add_header Permissions-Policy "geolocation=(), camera=(), microphone=(), payment=()" always;

Apache

Header always set Permissions-Policy "geolocation=(), camera=(), microphone=(), payment=()"

Cloudflare

Rules → Transform Rules → Modify Response Header → set `Permissions-Policy` to your directive list.

Verify the fix

After deploying the change, re-run a Nivaronix scan on your domain, or check with curl -sI https://your-domain.example, to confirm the header now appears in the response.

Back to all security header guidesWebsite security scanner

Standards reference

MDN — Permissions-Policy. For exactly how Nivaronix evaluates this header during a scan, see the methodology page.