Security headers

How to fix: Permissions-Policy header

Permissions-Policy lets you switch off browser features, such as the camera, microphone or geolocation, for your pages and any third-party content embedded in them.

Not sure whether your site has this problem? Check it in seconds.

Run a free audit

Why it matters

If a compromised script or a third-party embed tries to use a sensitive feature, the policy can stop it. It's about limiting what embedded content can do, not a fix for vulnerabilities by itself.

How to check

Look for Permissions-Policy in the response headers. It replaces the older Feature-Policy header.

How to fix it

Header value

Permissions-Policy: camera=(), microphone=(), geolocation=()

Nginx

add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

Apache

Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"

Next.js (next.config.ts)

const nextConfig = {
  async headers() {
    return [
      {
        source: "/:path*",
        headers: [{ key: "Permissions-Policy", value: "camera=(), microphone=(), geolocation=()" }],
      },
    ];
  },
};
export default nextConfig;

Common mistakes

Disabling a feature your own site uses, for example camera=() on a page that scans QR codes. Use camera=(self) to allow only your own pages.
Using the old Feature-Policy syntax: Permissions-Policy uses parentheses, for example geolocation=(self).

Frequently asked questions

Does it affect SEO?

No. It only changes what browser features pages may use.

Related guides

Guidance is general. Test header and DNS changes on a staging copy first, and check your hosting provider's documentation for platform-specific steps.