Add a Permissions-Policy

Why it matters

Without one, any script on your pages, including injected or third-party code, can ask visitors for the camera, microphone, location and similar features. Turning off what you do not use limits what such code can request.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. List the features the site uses: a store locator needs geolocation, Apple Pay or the Payment Request API needs payment, video calls need camera and microphone.
2. Send the policy below with () for features you do not use and (self) for those you do; embedded partners that need one are listed by origin, for example geolocation=(self "https://maps.example").
3. Test the pages that use those features after deploying.

Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=()

Read the documentation ↗(opens in a new tab)

Related

• Reported by the Permissions-Policy check
• Replace Feature-Policy with Permissions-Policy
• Fix the Permissions-Policy syntax
• Stop allowing powerful features for every origin