No Permissions-Policy

Why it matters

Embedded third-party content can ask for sensitive browser features (camera, microphone, location) on your pages.

How to fix it

Send a Permissions-Policy that disables what you don't use, e.g. Permissions-Policy: camera=(), microphone=(), geolocation=().

Related security checks

• Content-Security-Policy is too permissive
• Forms submitted over plain HTTP
• HTTP does not redirect to HTTPS
• Missing or leaky Referrer-Policy