Home / Fix guides / Permissions-Policy

Set a Permissions-Policy to switch off camera, mic and location

Hardening

Permissions-Policy lets you switch off powerful browser APIs your app doesn't need.

Why it matters

A nice-to-have hardening step; it limits damage from injected or third-party scripts.

Quick fix

Add Permissions-Policy: camera=(), microphone=(), geolocation=() (leave out any feature you use).

Step by step

Add the header

# public/_headers (Netlify and Cloudflare Pages)
/*
  Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
  X-Frame-Options: DENY
  X-Content-Type-Options: nosniff
  Referrer-Policy: strict-origin-when-cross-origin
  Permissions-Policy: camera=(), microphone=(), geolocation=()

Prompt for your AI builder

Paste this into Lovable, Bolt, v0, Cursor or Replit, then review the changes before deploying.

Add a Permissions-Policy header that disables camera, microphone and geolocation (unless my app uses them) to every response.

References

MDN: Permissions-Policy

Check your app

Run a free scan