Permissions-Policy set

What this means

Passing means the response carries a Permissions-Policy header. Failing means it is absent, so every browser feature stays available to your page and to anything embedded in it. The header lists the features your site uses and switches off the rest.

How we test it

We read the headers on the home page response and look for permissions-policy. Any value passes. Absent fails. We do not score which features are allowed, only that the header exists.

Why it matters

Turns off camera, microphone and location APIs the site never uses. If a script you did not write ends up in the page, this header is what stops it from asking the visitor for their location or their camera in your name. The kit's value also opts the site out of two browser advertising features and allows the payment API only for your own origin and the payment provider's checkout.

The fix

Add the Permissions-Policy header from the kit template to the /(.*) headers block in vercel.json or to securityHeaders in next.config.ts, with the value camera=(), microphone=(), geolocation=(), interest-cohort=(), browsing-topics=(), payment=(self "https://checkout.stripe.com"). Confirm with curl -sI https://YOUR_DOMAIN | grep -i '^permissions-policy', expected one line naming those features. The full runbook is in the Fix Kit, Module 01.

Prompt for your AI

Paste this into the coding agent that built the app. It reproduces the finding and stops before changing anything; the fix steps are in the kit.

Do not change anything. This is a verification pass.
Run: curl -sI https://YOUR_DOMAIN | grep -i '^permissions-policy' and show me the output, or tell me it is empty.
Open vercel.json or next.config at the repo root and show me any Permissions-Policy entry, or tell me there is none.
Search the source for uses of the camera, microphone, geolocation or payment browser APIs and tell me which, if any, the site actually calls.
List what it would take to add the header to every route, and stop there.
Run: curl -sI https://YOUR_DOMAIN | grep -ic '^permissions-policy' and show me the output. Expected on a passing site: 1.