# Permissions-Policy

> Permissions-Policy is an HTTP header that turns browser features such as the camera, microphone or geolocation on or off for a page and its frames.

- **Check ID:** SEC7
- **Area:** [Security](https://be1st.ai/glossary/security)
- **Tool:** [SEO + Security + Performance](https://be1st.ai/tools/ssp-audit)
- **Page:** https://be1st.ai/glossary/security/permissions-policy

## Why it matters

Without Permissions-Policy, a malicious iframe embedded via an ad or third-party widget can access the user's camera, microphone, or geolocation. This header allows you to explicitly disable APIs that the website does not need, thereby reducing the attack surface.

## In practice

Stripe.com sets Permissions-Policy: camera=(), microphone=(), geolocation=(), which disables access to camera, microphone, and geolocation across the entire website. If a malicious script were to get onto the page, it could not activate these sensors.

## How be1st checks it

Checks for the presence of the Permissions-Policy HTTP header (formerly Feature-Policy), which restricts the page's and embedded iframes' access to sensitive browser APIs such as camera, microphone, geolocation, payment API, and others.

[SEO + Security + Performance](https://be1st.ai/tools/ssp-audit), Security tab.

Every check ends as: Pass, Warning, Fail.

## Sources

- [Permissions-Policy header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Permissions-Policy) (MDN)
- [Permissions Policy guide](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Permissions_Policy) (MDN)

## Related terms

- [Mixed content](https://be1st.ai/glossary/security/mixed-content): Mixed content means resources, such as images or scripts, that an HTTPS page loads over unencrypted HTTP. Browsers block or flag them.
- [Security warnings](https://be1st.ai/glossary/security/security-warnings): Security warnings are messages the browser writes to its console when it finds a security problem on a page, such as a blocked resource or an invalid policy.
- [Insecure cookies](https://be1st.ai/glossary/security/insecure-cookies): An insecure cookie is a cookie set without the Secure, HttpOnly or SameSite attribute, which leaves it open to theft or misuse by other sites.
- [Deprecated APIs](https://be1st.ai/glossary/security/deprecated-apis): Deprecated APIs are browser features that are being phased out. Code that still uses them can stop working once browsers remove them.
- [HTTPS (security)](https://be1st.ai/glossary/security/https): HTTPS is HTTP encrypted with TLS. It keeps passwords, forms and cookies private on the way between the visitor and the server.
- [Strict-Transport-Security (HSTS)](https://be1st.ai/glossary/security/strict-transport-security-hsts): Strict-Transport-Security (HSTS) is an HTTP header that tells browsers to use a website only over HTTPS for a set time, even when someone types or links http://.