No Permissions-Policy header

SeverityInfo

ScopeWhole site

EffortSmall

Verified bySecurity scan (weekly, or Re-scan)

Rule keysec_permissions_policy

Short answer

Permissions-Policy lets you switch off powerful browser features the site never uses, such as camera, microphone, geolocation or USB, for your pages and for every iframe they embed. It is a hardening measure: if an injected script or a compromised third-party widget tries to use those features, the browser refuses without even asking the visitor. It has no effect on rankings.

Why it matters

Without the header, any script on your page and any embedded iframe can request the features the browser supports, limited only by the visitor's permission prompt. An attacker who manages to inject a script, or a hijacked ad or widget, can use that to show a convincing location or camera prompt under your domain name. A feature turned off with () never prompts, so a visitor cannot be tricked into granting it.

The risk is indirect, which is why this is Info. Adding the header takes a few minutes and has no SEO effect.

How Glimana detects it

Glimana reads the response headers of your HTTPS home page. The check passes when a Permissions-Policy header with at least one directive is present; an empty header switches nothing off and is reported like a missing one. Glimana does not judge which features you allowed. The older Feature-Policy header does not count. A missing or empty header is reported as Info.

How to fix it

Watch out

Do not disable features you use. Embedded YouTube or Vimeo players need fullscreen, store locators and delivery maps may need geolocation, and some checkout widgets need payment. The syntax also differs from the old Feature-Policy: write camera=(), not camera 'none'. Browsers silently ignore entries they cannot parse, so check the browser console after the change.

Find the finding in Glimana. Open Security; this check is in the Security headers group, with the evidence from the last scan under its title. The same problem is listed under Issues › No Permissions-Policy header.
Apply the fix on your platform.

WordPressCloudflareApache / Nginx

On Apache or LiteSpeed hosting add to .htaccess: Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(), usb=()" (needs mod_headers). Add payment=() only if your site takes no payments through browser payment buttons. Several security and header plugins offer the same as a setting.

Rules › Overview › Create rule › Response Header Transform Rule, all incoming requests, Set static, header name Permissions-Policy, value camera=(), microphone=(), geolocation=(), usb=().

Apache: Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(), usb=()". Nginx, in the HTTPS server block: add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), usb=()" always; then reload. To allow a feature only for your own pages, use self, for example geolocation=(self).
Check it in Glimana. Press Re-scan on the Security page (up to two scans an hour) or wait for the weekly scan on Sunday; the problem closes when the check passes.

How the fix is verified

After fixing, press Re-scan on the Security page (or wait for the weekly Sunday scan); the problem closes as soon as the check passes.