What it is

Without a Permissions-Policy header, browser features like the camera, microphone or geolocation aren't explicitly restricted at the page level — not a direct hole by itself, but one less layer of defense if a malicious script ever runs on the page.

How to fix it

Add a Permissions-Policy header that disables features your site doesn't use. If you're not sure how, install the WordPress Plugin: its Security tab applies fixes like this one automatically.

In depth

Your website is missing a security setting that tells visitors' browsers which features they're allowed to use when visiting your site. Think of it like a bouncer at a door who controls what tools people can bring inside, except here you're controlling what your visitors' cameras, microphones, and location services can do. Right now, if a hacker managed to sneak malicious code onto your site, they could potentially access these features on visitors' browsers, which you definitely don't want. This isn't an emergency because hackers would need to get code onto your site first, but it's a smart extra layer of protection to add. The fix is straightforward: you'll add a Permissions-Policy header through WordPress, which is basically telling browsers "hey, nobody needs a camera or microphone on my site, so block access to those." The easiest way to do this is installing a security plugin that handles this automatically for you without you needing to touch any code yourself.