EngineeringScoreMigrate Feature-Policy to Permissions-Policy
Feature-Policy was the original name for the header that later shipped as Permissions-Policy: same purpose (restricting which browser features a page and its embedded frames may use), a slightly different syntax. Chromium removed support for parsing the Feature-Policy header years ago, so a site that still ships only Feature-Policy is not protected in Chrome, Edge, or any other Chromium-based browser, despite having done the real design work of deciding what to restrict.
Why it matters
Feature-Policy was renamed and restructured as Permissions-Policy years ago, and current Chromium-based browsers no longer read the old header at all: a site that only ships Feature-Policy is protected in no browser that matters today, even though the restriction was correctly designed once. The syntax is a near-literal translation, so the fix is a rename with a small syntax change, not a redesign.
How to fix
- 1 List the directives already declared in the Feature-Policy header.
- 2 Translate each to Permissions-Policy syntax (e.g. `geolocation 'self'` becomes `geolocation=(self)`).
- 3 Add the resulting Permissions-Policy header alongside or in place of Feature-Policy.
- 4 Re-test any embedded widgets that rely on the restricted features.
Common mistakes
- Assuming the header still works because it was correctly configured once and nothing in the deploy pipeline flagged it as broken: HTTP headers do not fail loudly when a browser stops reading them.
- Copying the Feature-Policy value verbatim into a Permissions-Policy header without converting the syntax (`geolocation 'self'` is not valid Permissions-Policy syntax; it must become `geolocation=(self)`), producing a header that parses to nothing.
- Removing Feature-Policy the moment Permissions-Policy ships, when a short overlap period protects the shrinking pool of older browsers that still only read the legacy header.
How to verify
- 1 Inspect the response headers for a Permissions-Policy header with the same restrictions the old Feature-Policy header declared.
- 2 Re-run the scan and confirm the finding now reports the modern header as present.
- 3 Test any embedded widget that depends on a restricted feature (camera, geolocation, payment) to confirm it still receives access where intended.
Related checks
Ready to see where you stand?
Scan your site and get your Engineering Score with a prioritized roadmap in under a minute, no signup required.