Stop allowing powerful features for every origin on Cloudflare

headers.permissions.wildcard · effort: minutes

Why it matters

A feature set to * can be passed to any embedded site you give an allow attribute, such as an ad frame. Restrict it to your origin or named partners.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

Edit the Response Header Transform Rule (Rules, Overview) that sets Permissions-Policy and replace * with () or (self); if the origin sets it, change it there.
Test the pages and embeds that use those features.

Read the documentation (opens in a new tab)

Scan your domain to see whether this applies to you.