Optional hardening

Your pages do not restrict camera, microphone or location access

This is the exact wording EverThread uses when it finds this on a customer's site, written for someone who runs a business, not a server. The example site here is yourbakery.com.

What we saw

The Permissions-Policy header is missing.

Why it matters

An injected script could ask visitors for camera or location access in your name.

How to fix it

Send the technical line below to whoever runs your site. Each of these is a one-line change in the server or hosting settings, and none of them changes how the site looks.

For your developer