Stop allowing powerful features for every origin

headers.permissions.wildcard · effort: minutes

Why it matters

A feature set to * can be passed to any embedded site you give an allow attribute, such as an ad frame. Restrict it to your origin or named partners.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

Replace * with () if the site does not use the feature, (self) if only your pages do, or (self "https://partner.example") for a specific embedded partner.
Test the pages and embeds that use those features after deploying.

http

Permissions-Policy: camera=(), microphone=(), geolocation=(self), payment=(self)

Scan your domain to see whether this applies to you.