Permissions-Policy header: Crawl Audit check 151

Short answer: Permissions-Policy says which browser features, such as the camera, microphone and location, your page and anything embedded in it may use. Switching off what you don't need limits what a third-party embed or injected script could ask visitors for. Check 151 warns if you don't set it.

What Crawl Audit checks

• Pass: a Permissions-Policy header, or the older Feature-Policy header.
• Warning: neither.

What MDN says

• The header "provides a mechanism to allow and deny the use of browser features in a document or within any <iframe> elements in the document."
• "By specifying () for the origin list, the specified features will be disabled for all browsing contexts (this includes all <iframe>s), regardless of their origin."
• MDN marks the header as experimental with limited browser support, so treat it as an extra layer, not your only control.

Writing one

• () turns a feature off everywhere, including your own pages.
• (self) allows your own pages and blocks frames from other sites.
• (self "https://maps.example.com") also allows one named site, which then needs the matching allow attribute on its iframe.

Permissions-Policy: camera=(), microphone=(), geolocation=()

Start with the features you know you don't use. If a page later needs one, such as a store finder that asks for location, change that feature to (self).

On devmarde.com

We added camera=(self), microphone=(self), geolocation=(self) on 6 October. None of our pages use these today. We chose (self) rather than () so that a future tool of our own, such as a barcode scanner, wouldn't break, while embedded frames from other sites stay blocked.

Sources

• MDN, Permissions-Policy (updated 14 September 2026).
• OWASP, HTTP Headers Cheat Sheet, checked 6 October 2026.