AI Cyber Shield

How to add the Permissions-Policy header

Permissions-Policy decides which browser features (camera, microphone, location) your pages and the third-party scripts on them may ask for.

The example blocks camera, microphone and location. If your site uses one of them (video chat, a map that locates the user), leave it allowed.

How to fix it, by platform

WordPress

Where: your theme's functions.php (or a snippets plugin)

add_action('send_headers', function () {
  header("Permissions-Policy: geolocation=(), microphone=(), camera=()");
});

WordPress sends the Permissions-Policy header on every page load.

How to confirm: Reload the site and check the response headers include `Permissions-Policy`.

Cloudflare

Where: Cloudflare dashboard → Rules → Transform Rules → Modify Response Header → Add

Set static  —  Header name: Permissions-Policy  —  Value: geolocation=(), microphone=(), camera=()

Cloudflare injects the Permissions-Policy header at the edge, no server change needed.

How to confirm: Reload the site and check the response headers include `Permissions-Policy`.

Vercel / Next.js

Where: next.config.js → async headers()

module.exports = {
  async headers() {
    return [{ source: "/(.*)", headers: [
      { key: "Permissions-Policy", value: "geolocation=(), microphone=(), camera=()" },
    ]}];
  },
};

Next.js sets the Permissions-Policy header on every route.

How to confirm: Reload the site and check the response headers include `Permissions-Policy`.

Netlify

Where: a `_headers` file in your publish directory (or netlify.toml)

/*
  Permissions-Policy: geolocation=(), microphone=(), camera=()

Netlify applies the Permissions-Policy header to all paths (`/*`).

How to confirm: Reload the site and check the response headers include `Permissions-Policy`.

Nginx

Where: nginx.conf — inside your `server { }` block, then reload nginx

add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;

Adds the Permissions-Policy header for every response.

How to confirm: Reload the site and check the response headers include `Permissions-Policy`.

Apache

Where: .htaccess (or the vhost config), then restart Apache

Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"

Adds the Permissions-Policy header via mod_headers.

How to confirm: Reload the site and check the response headers include `Permissions-Policy`.

IIS

Where: web.config — inside <system.webServer><httpProtocol><customHeaders>

<add name="Permissions-Policy" value="geolocation=(), microphone=(), camera=()" />

Adds the Permissions-Policy header in IIS.

How to confirm: Reload the site and check the response headers include `Permissions-Policy`.

Your web server

Where: your web server's response-header configuration

Permissions-Policy: geolocation=(), microphone=(), camera=()

Configure your server/CDN to send this header on all responses.

How to confirm: Reload the site and check the response headers include `Permissions-Policy`.

Not sure your site needs this fix? A scan checks this and dozens of other things and shows what yours is missing.

Scan your site free

Related guides