No Permissions-Policy is set
What this check looks for
You have not restricted which browser features the page — and anything embedded in it — may use, such as the camera, microphone or location.
Why it matters
Nothing is wrong. It matters most when the page embeds third-party frames: without a policy, an embedded advert or widget can request features under your site's name.
When the check passes, your report says: “A Permissions-Policy limits the browser features the page may use”.
What it costs your score
This check never deducts. It reports a fact — or reports that something could not be verified — and is shown on the report without moving the score.
- Severity
- info
- Default confidence
- confirmed
- Status when triggered
- info
- Deduction
- 0 points
- Family cap
- none
- Category
- Web security
- Module
- Web security headers
- Fix owned by
- user
- In the ruleset since
- 2026.09
Technical detail
‹detail›
The syntax is feature=(allowlist), for example camera=(), microphone=(), geolocation=(self). An empty list denies the feature to everyone including your own page. Note this header does not accept the older Feature-Policy syntax; a value in that form is ignored.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.
Other web security headers checks
- No Cross-Origin-Embedder-Policy is set
- No Cross-Origin-Opener-Policy is set
- No Cross-Origin-Resource-Policy is set
- No Content Security Policy is enforced
- The policy leaves plugins or the base URL unrestricted
- The Content Security Policy is report-only
- The policy allows eval()
- The policy allows inline scripts or styles
- The policy allows resources from anywhere
- A security header was sent twice with different values
- HSTS max-age is shorter than six months
- HTTP Strict Transport Security is not in force