What is it?
Permissions-Policy is an HTTP response header that controls access to browser features such as camera, microphone, geolocation, payment, fullscreen, and other APIs.
Why does it matter?
Most websites do not need access to sensitive browser capabilities. A restrictive policy reduces the impact of injected third-party content, unexpected embeds, or browser feature misuse.
How to fix it?
Disable features the site does not use, then allow only the features and origins required by the product.
Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=()If a feature is intentionally used, test the relevant user flow before blocking it. Apply the header at the CDN, reverse proxy, or application layer.