Migrate Feature-Policy to Permissions-Policy
Feature-Policy was the original name for the header that later shipped as Permissions-Policy: same purpose (restricting which browser features a page and its embedded frames may use), a slightly different syntax. Chromium removed support for parsing the Feature-Policy header years ago, so a site that still ships only Feature-Policy is not protected in Chrome, Edge, or any other Chromium-based browser, despite having done the real design work of deciding what to restrict.
Find out whether your site has this problem, and every other check, in one free scan.
Check your site freeWhy it matters
Feature-Policy was renamed and restructured as Permissions-Policy years ago, and current Chromium-based browsers no longer read the old header at all: a site that only ships Feature-Policy is protected in no browser that matters today, even though the restriction was correctly designed once. The syntax is a near-literal translation, so the fix is a rename with a small syntax change, not a redesign.
How to fix
- 1 List the directives already declared in the Feature-Policy header.
- 2 Translate each to Permissions-Policy syntax (e.g. `geolocation 'self'` becomes `geolocation=(self)`).
- 3 Add the resulting Permissions-Policy header alongside or in place of Feature-Policy.
- 4 Re-test any embedded widgets that rely on the restricted features.
Common mistakes
- Assuming the header still works because it was correctly configured once and nothing in the deploy pipeline flagged it as broken: HTTP headers do not fail loudly when a browser stops reading them.
- Copying the Feature-Policy value verbatim into a Permissions-Policy header without converting the syntax (`geolocation 'self'` is not valid Permissions-Policy syntax; it must become `geolocation=(self)`), producing a header that parses to nothing.
- Removing Feature-Policy the moment Permissions-Policy ships, when a short overlap period protects the shrinking pool of older browsers that still only read the legacy header.
How to verify
- 1 Inspect the response headers for a Permissions-Policy header with the same restrictions the old Feature-Policy header declared.
- 2 Re-run the scan and confirm the finding now reports the modern header as present.
- 3 Test any embedded widget that depends on a restricted feature (camera, geolocation, payment) to confirm it still receives access where intended.
Related checks
Ready to see where you stand?
Scan your site and get your Engineering Score with a prioritized roadmap in under a minute, no signup required.