Missing permissions policy
Quick winAdd a Permissions-Policy HTTP response header to explicitly restrict which browser features (camera, microphone, geolocation, etc.) your store's pages are allowed to use.
What it is
The Permissions-Policy header (formerly called Feature-Policy) is a security instruction your web server sends to every visitor's browser. It acts like a bouncer's list for powerful browser features — it tells the browser exactly which features your site is allowed to use, and blocks everything else. For example, you can declare that your store never needs access to a visitor's camera, microphone, or precise location, so even if malicious code was somehow injected into your page, the browser would refuse to grant that access. Without this header, browsers apply loose default rules, leaving those features potentially available to any script running on your pages.
Why it matters
Missing this header is flagged under OWASP A05:2021 (Security Misconfiguration) — one of the most common vulnerability categories found on real sites. If third-party scripts (ad networks, chat widgets, analytics) or injected malicious code try to silently access a shopper's camera, microphone, or location, nothing at the browser level stops them without this header. For an ecommerce store, that is a direct privacy and trust risk: a single reported incident of covert data capture can destroy customer confidence and trigger GDPR/CCPA regulatory scrutiny. Adding this header is a low-effort, high-signal security hardening step that security auditors and increasingly Google's ranking systems look for as a mark of a trustworthy site.
How to fix it
- Decide which browser features your store legitimately needs. Most stores need none of the sensitive ones (camera, microphone, geolocation, payment, USB, etc.), so the safest default is to disable them all.
- Compose your Permissions-Policy header value. A safe baseline for most stores is: `camera=(), microphone=(), geolocation=(), payment=(), usb=(), fullscreen=(self)`. Each empty `()` means 'no origin, including your own, may use this feature'; `(self)` means only your own origin may use it.
- Deliver the header on every HTTP response from your store — ideally at the server/CDN/edge level so it applies to all pages automatically, not just one template.
- If you use a CDN or reverse proxy (Cloudflare, Fastly, etc.), configure the header there so it is added to all responses without touching individual platform settings.
- After deploying, verify the header is present by opening Chrome DevTools → Network tab → click any page request → look under Response Headers for 'Permissions-Policy'. Alternatively, use securityheaders.com to scan your domain.
- Review and update the policy whenever you add a new third-party embed that legitimately needs a browser feature (e.g., a video-chat app that needs the camera) — add only that specific allowed origin.
Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), fullscreen=(self)Fix it on your platform
Pick your platform for the exact steps.
How to fix missing permissions policy on Shopify
- Shopify's shared infrastructure does not expose a web-server config file (no .htaccess or nginx.conf), so you cannot set arbitrary response headers directly.
- The best approach is to use a Shopify app that injects security headers: search the Shopify App Store for 'Security Headers' apps (e.g., 'EasyAuth Security Headers' or 'Locksmith' for edge-level header injection).
- Alternatively, if your store is behind Cloudflare, add the header there (see Cloudflare steps below) — this is the most reliable method for Shopify stores.
- For a theme-level partial workaround: in the Shopify Admin go to Online Store → Themes → Actions → Edit Code. Open layout/theme.liquid and add a <meta http-equiv='Permissions-Policy' content='camera=(), microphone=(), geolocation=()'> tag inside the <head> section. Note: meta http-equiv is NOT a true HTTP header and offers weaker protection, but it is the only native in-theme option available without server access.
- Verify by loading your storefront and checking Response Headers in browser DevTools Network tab.
How to fix missing permissions policy on Shopify Plus
- Shopify Plus merchants have access to Cloudflare as part of their infrastructure — use Cloudflare Transform Rules to add the Permissions-Policy header (see generic Cloudflare steps: Transform Rules → Modify Response Headers → Add header name 'Permissions-Policy' with your policy value).
- Alternatively, use a Shopify app from the App Store that manages security response headers.
- In the Admin: Online Store → Themes → Actions → Edit Code → layout/theme.liquid — add the meta http-equiv fallback in <head> as a supplementary measure.
- Verify with Chrome DevTools → Network → Response Headers.
How to fix missing permissions policy on WooCommerce
- WooCommerce runs on WordPress.org, typically on Apache or Nginx — you can set the header at the server level or via plugin.
- Easiest plugin method: Install the free 'Headers Security Advanced & HSTS WP' plugin or 'HTTP Headers' plugin from the WordPress plugin directory (Plugins → Add New → search 'Permissions Policy headers').
- In the chosen plugin's settings page, find the Permissions-Policy field and enter your policy value: camera=(), microphone=(), geolocation=(), payment=(), usb=(), fullscreen=(self). Save.
- Apache server-level alternative: Add to your .htaccess file (found in the WordPress root directory via FTP/File Manager): `Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"` — requires mod_headers to be enabled.
- Nginx server-level alternative: Add to your server {} block in your nginx.conf or site config: `add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;` then reload Nginx.
- Verify with Chrome DevTools → Network tab → Response Headers, or use securityheaders.com.
How to fix missing permissions policy on WordPress.org
- Install a security headers plugin: go to Plugins → Add New, search for 'HTTP Headers' or 'Headers Security Advanced & HSTS WP', install and activate.
- Open the plugin's settings panel and locate the Permissions-Policy (or Feature-Policy) section. Enter the policy value: camera=(), microphone=(), geolocation=(), payment=(), usb=(), fullscreen=(self).
- Save settings. The plugin will add the header to all WordPress responses via PHP's header() function.
- Alternatively, add directly to your theme's functions.php (Appearance → Theme File Editor → functions.php): add_action('send_headers', function(){ header("Permissions-Policy: camera=(), microphone=(), geolocation=()"); });
- Verify with browser DevTools or securityheaders.com.
How to fix missing permissions policy on BigCommerce
- BigCommerce is a hosted SaaS platform — direct server-level header configuration is not available to merchants.
- The recommended approach is to front your store with Cloudflare (free tier is sufficient) and add the Permissions-Policy header via Cloudflare Transform Rules: Log in to Cloudflare → select your domain → Rules → Transform Rules → Modify Response Headers → Create Rule → Add header: Name = 'Permissions-Policy', Value = 'camera=(), microphone=(), geolocation=(), payment=(), usb=()'.
- As a partial fallback, go to BigCommerce Admin → Storefront → Script Manager → Create Script. Set Location = Head, add a <meta http-equiv='Permissions-Policy' content='camera=(), microphone=(), geolocation=()'> tag. This is not a true HTTP header but provides some browser-level hint.
- Verify via Chrome DevTools → Network → Response Headers after the Cloudflare rule is live.
How to fix missing permissions policy on Wix
- Wix is a fully hosted platform and does not allow direct HTTP response header customisation through the admin panel.
- The only viable method is to proxy your Wix site through Cloudflare and inject the header at the Cloudflare edge: add your Wix domain to Cloudflare → Go to Rules → Transform Rules → Modify Response Headers → Add 'Permissions-Policy' header with your policy value.
- There is no Wix-native way to set true HTTP security headers without a proxy layer.
- Verify the header is present using Chrome DevTools → Network → Response Headers once Cloudflare is active.
How to fix missing permissions policy on Wix Studio
- Like standard Wix, Wix Studio does not provide access to server-level HTTP response headers.
- Proxy your site through Cloudflare and use Transform Rules → Modify Response Headers to add: Name = 'Permissions-Policy', Value = 'camera=(), microphone=(), geolocation=(), payment=(), usb=()'.
- Verify with Chrome DevTools → Network tab → Response Headers.
How to fix missing permissions policy on Squarespace
- Squarespace does not allow direct HTTP header configuration from the admin panel.
- Add your domain to Cloudflare (change your domain's nameservers at your registrar to Cloudflare's), then in Cloudflare: Rules → Transform Rules → Modify Response Headers → Create a rule to add 'Permissions-Policy' header.
- As a limited fallback, go to Squarespace Admin → Settings → Advanced → Code Injection → Header section and add: <meta http-equiv='Permissions-Policy' content='camera=(), microphone=(), geolocation=()'> — this is not a true HTTP header but is the only native option.
- Verify using Chrome DevTools → Network → Response Headers.
How to fix missing permissions policy on Webflow
- Webflow does not expose HTTP header configuration natively in its hosting dashboard for standard plans.
- For Webflow Enterprise, contact support or use the site settings to configure custom headers if available in your plan.
- For all other plans, use Cloudflare as a proxy: add your Webflow site's domain to Cloudflare → Rules → Transform Rules → Modify Response Headers → Add header 'Permissions-Policy' with value 'camera=(), microphone=(), geolocation=(), payment=(), usb=()'.
- Alternatively, in Webflow Designer → Project Settings → Custom Code → Head Code, add: <meta http-equiv='Permissions-Policy' content='camera=(), microphone=(), geolocation=()'> as a partial browser hint.
- Verify with Chrome DevTools → Network → Response Headers.
How to fix missing permissions policy on Adobe Commerce (Magento)
- For Apache-based deployments: edit your .htaccess file in the Magento root directory or your virtual host config and add: `Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=()"` — ensure mod_headers is enabled in Apache.
- For Nginx-based deployments: add to your nginx.conf server {} block: `add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=()" always;` then run `nginx -t` to validate and `systemctl reload nginx`.
- Alternatively, add the header programmatically via a custom Magento module: create a plugin on Magento\Framework\App\Response\Http that calls $response->setHeader('Permissions-Policy', 'camera=(), microphone=(), geolocation=()', true); in an afterSendResponse method.
- If using Adobe Commerce Cloud, add the header in your .magento.app.yaml or via Fastly (the bundled CDN): Stores → Configuration → Advanced → System → Full Page Cache → Fastly Configuration → Custom VCL Snippets, or use Fastly's response header rules.
- Flush the full-page cache after any change: System → Cache Management → Flush Magento Cache.
- Verify with Chrome DevTools → Network → Response Headers.
How to fix missing permissions policy on Magento Open Source
- For Apache: add to .htaccess in Magento root: `Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"` (requires mod_headers).
- For Nginx: add to your server {} block: `add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;` and reload Nginx.
- Alternatively, build a small custom module that adds the header via an event observer or plugin on the HTTP response object.
- Clear caches: php bin/magento cache:flush
- Verify via Chrome DevTools Network tab or securityheaders.com.
How to fix missing permissions policy on PrestaShop
- For Apache: edit .htaccess in PrestaShop root (Back Office → Advanced Parameters → Performance has a 'Generate htaccess' option — edit the generated file or add via FTP): add `Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"`
- For Nginx: add `add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;` to your server block and reload Nginx.
- Alternatively, create a custom PrestaShop module that hooks into actionDispatcher or uses PHP's header() call early in the bootstrap to set the header.
- Verify with Chrome DevTools or securityheaders.com.
How to fix missing permissions policy on Next.js
- Open next.config.js in your project root.
- Add or extend the `headers()` async function to return the Permissions-Policy header for all routes: async headers() { return [{ source: '/(.*)', headers: [{ key: 'Permissions-Policy', value: 'camera=(), microphone=(), geolocation=(), payment=(), usb=()' }] }] }
- Save the file and restart your Next.js server (npm run build && npm start for production).
- Verify with Chrome DevTools → Network → Response Headers.
Does your site have this issue?
Run a free SEOLZ audit to find missing permissions policy — and every other issue — across your whole site in minutes.
Scan my site freeFrequently asked questions
What is Missing permissions policy?
The Permissions-Policy header (formerly called Feature-Policy) is a security instruction your web server sends to every visitor's browser. It acts like a bouncer's list for powerful browser features — it tells the browser exactly which features your site is allowed to use, and blocks everything else. For example, you can declare that your store never needs access to a visitor's camera, microphone, or precise location, so even if malicious code was somehow injected into your page, the browser would refuse to grant that access. Without this header, browsers apply loose default rules, leaving those features potentially available to any script running on your pages.
Why does missing permissions policy matter?
Missing this header is flagged under OWASP A05:2021 (Security Misconfiguration) — one of the most common vulnerability categories found on real sites. If third-party scripts (ad networks, chat widgets, analytics) or injected malicious code try to silently access a shopper's camera, microphone, or location, nothing at the browser level stops them without this header. For an ecommerce store, that is a direct privacy and trust risk: a single reported incident of covert data capture can destroy customer confidence and trigger GDPR/CCPA regulatory scrutiny. Adding this header is a low-effort, high-signal security hardening step that security auditors and increasingly Google's ranking systems look for as a mark of a trustworthy site.
How do I fix missing permissions policy?
Add a Permissions-Policy HTTP response header to explicitly restrict which browser features (camera, microphone, geolocation, etc.) your store's pages are allowed to use.
Authoritative references
- OWASP Top Ten — OWASP
- OWASP Cheat Sheet Series — OWASP
- Secure Headers Project — OWASP