Missing Permissions-Policy header

What it is

Without a Permissions-Policy header, browser features like the camera, microphone or geolocation aren't explicitly restricted at the page level — not a direct hole by itself, but one less layer of defense if a malicious script ever runs on the page.

How to fix it

Add a Permissions-Policy header that disables features your site doesn't use. If you're not sure how, install the WordPress Plugin: its Security tab applies fixes like this one automatically.