Optional hardening

Your pages do not restrict camera, microphone or location access

What it means

Browsers can give web pages access to powerful features: the camera, the microphone, the visitor's location, and more. Normally a page has to ask, and the visitor sees a prompt to allow or block it.

The Permissions-Policy header lets your site say up front which of those features it will never use. When a feature is switched off this way, the browser refuses it without even showing the prompt. That applies to your own scripts, to other companies' scripts on your page, and to anything embedded in a frame.

A common starting point is Permissions-Policy: camera=(), microphone=(), geolocation=(). The empty brackets mean nobody on your page may use that feature.

Why it matters

If a harmful script ever got onto your page, it could ask visitors for their camera or location while showing your name in the address bar. Many people click Allow on a site they trust. With the header in place, that request is never shown.

The protection is real but narrow. Browsers already ask before handing over these features, and support for the header varies. Chrome and Edge honor it fully, while support in other browsers is more limited.

That is why EverThread rates this as optional. It is a tidy extra layer, worth adding when you are already changing headers.

How to check your own site

1. Open your home page in Chrome, Edge or Firefox. Right-click the page, choose Inspect, and open the Network tab.
2. Reload the page. Click the first row in the list, which is the page itself, and look at the Response Headers section.
3. Look for permissions-policy. If it is not there, the header is missing. An older header called feature-policy does not count, because current browsers have replaced it.

How to fix it

Any website

1. List the features your site actually uses. A store locator with a "use my location" button uses geolocation. A video call or voice recording tool uses the camera or microphone. Most small business sites use none of them.
2. Switch off only the features you do not use. For most sites that is camera=(), microphone=() and geolocation=(), separated by commas.
3. If your own site uses a feature, allow just your site with self, as in geolocation=(self). If an embedded tool from another company needs it, add its address in quotes, as in camera=(self "https://video.example.com").
4. Be careful with payment. Apple Pay, Google Pay and similar checkout buttons can rely on it, so leave it out unless you know you do not need it.
5. This header only works when sent by the server. There is no page tag version.

WordPress

1. Headers are usually best set at the server or CDN, not inside WordPress.
2. Check your host's dashboard for a security headers setting. Names vary by host.
3. If your host runs Apache, add the lines from the Apache section below to the .htaccess file in your site's main folder.
4. A plugin is the fallback. Search the plugin directory for "security headers" and pick one that is actively maintained. Check any store locator, booking or contact plugin that asks for location after the change.

Shopify, Squarespace, Wix and other hosted builders

1. These platforms run the servers, so you usually cannot add custom headers, and this one has no page tag alternative.
2. If EverThread lists it on a hosted site, there is usually nothing to change. Since it is optional, it is fine to leave.

Cloudflare

1. Go to Rules and create a response header rule. Depending on your dashboard, this is under Transform Rules, then Modify Response Header, or under Rules, Overview, as a Response Header Transform Rule.
2. Apply it to all incoming requests. Choose Set static, enter Permissions-Policy as the header name and camera=(), microphone=(), geolocation=() as the value, then deploy.
3. Rules only apply to traffic that goes through Cloudflare, shown as an orange cloud in your DNS settings.

Apache (.htaccess)

1. Add these lines to the .htaccess file in your site's main folder, or to your server's site settings. This needs the mod_headers module, which most hosts have on.

<IfModule mod_headers.c>
  Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
</IfModule>

Nginx

1. Add this line inside your site's server block, then reload Nginx.

add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

What to send your developer

Send Permissions-Policy with an empty allowlist () for each powerful feature the site does not use. The syntax is a structured header: feature=() for none, feature=(self) for same origin, and quoted origins for others. Iframes also need a matching allow attribute to receive a feature, and they can never get more than the top-level policy grants. Remove any old Feature-Policy header and drop interest-cohort=(), which refers to a retired feature and only causes console warnings. Unknown feature names are ignored, so a typo fails silently: check the Console tab after deploying. See MDN on Permissions-Policy.

Permissions-Policy: camera=(), microphone=(), geolocation=(self), usb=(), serial=()

Common questions