Permissions-Policy lets you explicitly turn off browser features your site doesn't use — camera, microphone, geolocation, USB access — so that even if a third-party script or a compromised ad gets injected into your page, it can't silently request access to hardware it has no legitimate reason to touch.
Without this, scripts on your page can request access to camera, microphone, and geolocation. Disabling features you don't use eliminates that attack surface entirely.
Permissions-Policy provides genuine, granular control over which browser features and APIs your site and any embedded third-party content can actually access — camera, microphone, geolocation, and numerous other sensitive browser capabilities all fall under this header's control, and explicitly disabling unused features closes off potential attack surface even if a vulnerability elsewhere on your site were somehow exploited.
The genuine security value here comes from the principle of minimizing available attack surface — a site that explicitly disables access to browser features it doesn't actually use removes those specific capabilities from what any potential attacker, including a malicious third-party script that somehow gets injected, could actually access or abuse, even in a worst-case compromise scenario.
This header also provides genuine protection against a specific risk from third-party scripts and embedded content — without explicit restriction, embedded iframes or included third-party scripts can potentially access sensitive browser features by default, and this header lets you explicitly restrict what these third-party elements are actually permitted to access on your page.
The genuine configuration work here requires honestly auditing which browser features your site actually, legitimately uses, then explicitly disabling everything else — this represents real, deliberate security hardening rather than a single universal setting, since the specific features worth disabling depend on your site's actual, genuine functionality requirements.
The Permissions-Policy header is present and disables browser features your site doesn't actually use.
Fix it, then re-scan — the check confirms itself. No manual checkbox, the scan is the truth.
Run this check in H.I.V.E. →