Missing Permissions-Policy header

InfoAuto-fixableSecurityPer-page checksecurity_no_permissions_policy

What this means

The response sends no Permissions-Policy, so nothing restricts which browser features and APIs embedded content may use.

How to fix it

Send a Permissions-Policy disabling the features the page does not need, e.g. camera=(), microphone=(), geolocation=().

Fix effort

This check is auto-fixable: the change can be written and validated automatically, so CrawlX can open it as a pull request for review.

Authoritative source

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers

Related checks

More in Security

Redirect downgrades HTTPS to HTTP Mixed content on an HTTPS page Content-Security-Policy is report-only Missing Content-Security-Policy header Missing HSTS header All checks

Find every page this affects

CrawlX runs this check — and 161 others — across your whole site, ranks the findings by estimated impact, and opens the fixable ones as pull requests. Free for 500 URLs.

Start crawling free Browse all checks