EngineeringScoreSecurity Small
Add a Permissions-Policy header
Permissions-Policy (formerly Feature-Policy) lets a page explicitly declare which powerful browser features (camera, microphone, geolocation, USB, payment APIs) it and any embedded iframes are allowed to use. Without it, any script that ends up running on the page, including a compromised third-party ad or widget, can request access to those features.
Why it matters
Without a Permissions-Policy, any script running on the page, including third-party scripts and ads, can request access to the camera, microphone, or location, widening the damage a compromised script can do.
How to fix
- 1 Decide which browser features the site actually needs.
- 2 Add a Permissions-Policy header disabling the rest (camera=(), microphone=(), geolocation=(), etc.).
- 3 Re-test any embedded widgets that rely on these features.
Common mistakes
- Disabling a feature the site actually depends on (e.g. geolocation for a store-locator widget), breaking functionality instead of just tightening security.
- Forgetting the policy also constrains embedded iframes, so third-party widgets that need camera/mic access stop working until explicitly allowed.
- Treating this as a one-time setup instead of revisiting it whenever a new third-party embed or feature is added to the page.
How to verify
- 1 Inspect the response headers for a Permissions-Policy value that explicitly disables unused features.
- 2 Test any embedded widgets (maps, video, payment forms) that rely on browser features to confirm they still function.
- 3 Attempt to call a disabled API (e.g. navigator.geolocation.getCurrentPosition) from the browser console and confirm it is blocked.
Related checks
Ready to see where you stand?
Scan your site and get your Engineering Score with a prioritized roadmap in under a minute, no signup required.