Missing permissions policy
Quick winAdd a Permissions-Policy HTTP response header to your store to explicitly restrict which browser features (camera, microphone, geolocation, etc.) pages and embedded third-party scripts are allowed to access.
What it is
The Permissions-Policy header (formerly called Feature-Policy) is a short line of text your web server sends to every visitor's browser along with each page. It acts as a rulebook that tells the browser exactly which powerful device features — like the camera, microphone, GPS location, payment APIs, and more — your site is allowed to use, and which should be completely blocked. Without it, the browser applies its own default rules, and any third-party script or iframe embedded on your store could potentially request access to those features without your knowledge or consent.
Why it matters
Missing this header is flagged by OWASP as a Security Misconfiguration (A05:2021), meaning auditors, enterprise buyers, and PCI-DSS assessors will mark it as a finding that needs remediation. More practically: any malicious or compromised third-party script — an analytics tag, a chat widget, an ad pixel — could silently attempt to activate a shopper's camera or microphone; a Permissions-Policy header stops that cold. It also signals to Google and to privacy-conscious customers that your store follows security best practices, which protects conversion rates and brand trust. Some browser security warnings and privacy regulations (GDPR, CCPA) are increasingly tied to whether sites take proactive steps to limit unnecessary data collection capabilities.
How to fix it
- Decide which browser features your store legitimately needs. A typical ecommerce store needs none of camera, microphone, or geolocation by default — so all three should be blocked with empty parentheses ().
- Compose your Permissions-Policy header value. A safe baseline for most stores is: camera=(), microphone=(), geolocation=(), payment=(), usb=(), interest-cohort=(). Add or relax directives only for features you actually use (e.g. if you embed a Google Maps store-locator, you may need geolocation=(self)).
- Add the header to every HTTP response from your origin server — ideally at the server or CDN/edge level so it applies to all pages automatically.
- If you use a CDN or reverse proxy (Cloudflare, Fastly, Akamai), configure the header there so it is injected consistently even for cached responses.
- Verify the header is present by loading any page of your store in a browser, opening DevTools → Network tab → click the document request → inspect Response Headers for 'Permissions-Policy'.
- Re-test with a security scanner or browser extension (e.g. Security Headers at securityheaders.com) to confirm the header is present and correctly formed.
Fix it on your platform
Pick your platform for the exact steps.
How to fix missing permissions policy on Shopify
- Shopify's shared infrastructure does not let you set arbitrary HTTP response headers directly from the admin panel — you must use a Cloudflare proxy or a Shopify app.
- Option A (Cloudflare — recommended): Point your store's domain to Cloudflare (free plan works). In the Cloudflare dashboard go to your domain → Rules → Transform Rules → Modify Response Header → Create a rule. Set 'Header name' to 'Permissions-Policy' and 'Value' to 'camera=(), microphone=(), geolocation=(), payment=(), usb=(), interest-cohort=()'. Set the rule to apply to all requests (hostname matches your domain). Save and deploy.
- Option B (Shopify app): Search the Shopify App Store for 'security headers' apps (e.g. 'HTTP Headers' or 'Security & Compliance' apps). Install, then add the Permissions-Policy header and value through the app's UI.
- Verify by opening your storefront in a browser, DevTools → Network → select the HTML document → Response Headers — confirm 'permissions-policy' appears.
How to fix missing permissions policy on Shopify Plus
- Same options as standard Shopify apply. Shopify Plus merchants who have a dedicated Shopify-managed infrastructure can also contact Shopify Plus support to inquire about server-level header configuration, but the Cloudflare Transform Rule approach is faster and fully self-serve.
- In Cloudflare: domain → Rules → Transform Rules → Modify Response Header → Add 'Permissions-Policy' header with value 'camera=(), microphone=(), geolocation=(), payment=(), usb=(), interest-cohort=()'.
- Alternatively use a Shopify Plus Script or a compatible security-header app from the App Store.
How to fix missing permissions policy on WooCommerce
- You are running on WordPress + Apache or Nginx, so you can set headers at the server config or .htaccess level.
- Apache (.htaccess in your WordPress root): Open the .htaccess file via FTP/SFTP or cPanel File Manager. Add the directive shown in the code snippets section inside a <IfModule mod_headers.c> block.
- Nginx (nginx.conf or site config): Add the add_header directive shown in the code snippets section inside the relevant server {} or location / {} block, then run 'nginx -t' and reload nginx.
- WordPress plugin alternative: Install the 'HTTP Headers' plugin (by David Gwyer) or 'Security Headers' plugin from the WordPress plugin directory. Go to Settings → HTTP Headers (or the plugin's settings page) → add a new header named 'Permissions-Policy' with the value 'camera=(), microphone=(), geolocation=(), payment=(), usb=(), interest-cohort=()'.
- Verify in browser DevTools → Network → HTML document → Response Headers.
How to fix missing permissions policy on BigCommerce
- BigCommerce's SaaS infrastructure does not expose direct HTTP header configuration. Use a Cloudflare proxy or BigCommerce's built-in CDN header rules if on an Enterprise plan.
- Option A (Cloudflare): In your Cloudflare dashboard for the domain, go to Rules → Transform Rules → Modify Response Header. Create a rule: Header name = 'Permissions-Policy', Value = 'camera=(), microphone=(), geolocation=(), payment=(), usb=(), interest-cohort=()'. Match all hostnames. Save.
- Option B (BigCommerce Enterprise): Contact BigCommerce support or your TAM about configuring custom response headers at the CDN/edge layer.
- Verify the header appears in browser DevTools → Network → Response Headers on your storefront.
How to fix missing permissions policy on Adobe Commerce (Magento)
- For Apache: Edit your virtual host config or the .htaccess in the Magento web root. Add the header inside a <IfModule mod_headers.c> block (see code snippet).
- For Nginx: Edit your Magento nginx.conf or the site-specific config file. Add the add_header line inside the server {} block (see code snippet). Run 'nginx -s reload'.
- Alternatively, create a custom module or plugin: create a custom HTTP response plugin in app/code/YourVendor/SecurityHeaders/Plugin/ResponsePlugin.php that calls $response->setHeader('Permissions-Policy', 'camera=(), microphone=(), geolocation=(), payment=(), usb=(), interest-cohort=()'); in an aroundSendResponse method.
- If using Cloudflare or Fastly CDN in front of Magento: add the header via a Cloudflare Transform Rule or Fastly VCL snippet for the simplest approach.
- Run 'php bin/magento cache:flush' after any code change, then verify in DevTools.
How to fix missing permissions policy on Magento Open Source
- Same steps as Adobe Commerce (Magento) above — use .htaccess (Apache), nginx.conf (Nginx), a custom response plugin, or a CDN-level rule.
- Apache .htaccess (Magento web root): add the Header set directive inside <IfModule mod_headers.c> as shown in the code snippets.
- Nginx: add 'add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=(), interest-cohort=()" always;' in the server block.
- Flush Magento cache and verify in DevTools.
How to fix missing permissions policy on Wix
- Wix's fully hosted infrastructure does not allow custom HTTP response headers to be set from the dashboard as of 2024.
- The recommended workaround is to proxy your Wix site through Cloudflare. In Cloudflare: Rules → Transform Rules → Modify Response Header → create rule for your hostname, Header name = 'Permissions-Policy', Value = 'camera=(), microphone=(), geolocation=(), payment=(), usb=(), interest-cohort=()'. Save and deploy.
- Monitor Wix's product updates — custom header support may be introduced in future versions of Wix Studio.
- Verify the header is present in DevTools → Network → Response Headers after enabling Cloudflare.
How to fix missing permissions policy on Wix Studio
- Wix Studio currently shares the same infrastructure constraints as standard Wix — custom HTTP response headers are not configurable from the platform admin.
- Use Cloudflare as a proxy: Rules → Transform Rules → Modify Response Header, add 'Permissions-Policy' with value 'camera=(), microphone=(), geolocation=(), payment=(), usb=(), interest-cohort=()'.
- Verify in browser DevTools → Network tab → Response Headers.
How to fix missing permissions policy on Squarespace
- Squarespace does not provide a native interface for setting custom HTTP response headers.
- Use Cloudflare as your DNS proxy: In Cloudflare → Rules → Transform Rules → Modify Response Header → add 'Permissions-Policy' header with value 'camera=(), microphone=(), geolocation=(), payment=(), usb=(), interest-cohort=()'.
- Verify in browser DevTools → Network → Response Headers.
How to fix missing permissions policy on Webflow
- Webflow hosted sites do not natively expose custom response header configuration from the Designer or dashboard.
- Use Cloudflare proxy: point your Webflow custom domain through Cloudflare, then in Rules → Transform Rules → Modify Response Header → add 'Permissions-Policy' header with value 'camera=(), microphone=(), geolocation=(), payment=(), usb=(), interest-cohort=()'.
- If self-hosting Webflow exports on your own server (Node/Nginx/Apache), add the header at the server configuration level using the snippets below.
- Verify in DevTools → Network → Response Headers.
How to fix missing permissions policy on WordPress.org
- Option A — .htaccess (Apache): Open .htaccess in your WordPress root via FTP, SFTP, or your host's File Manager. Add the block from the Apache code snippet. Save.
- Option B — Plugin: In WordPress admin → Plugins → Add New, search for 'HTTP Headers' by David Gwyer or 'Security Headers'. Install and activate. Navigate to Settings → HTTP Headers → Add Header → Name: 'Permissions-Policy', Value: 'camera=(), microphone=(), geolocation=(), payment=(), usb=(), interest-cohort=()'. Save.
- Option C — functions.php (child theme): Add the PHP snippet from the code snippets section to your child theme's functions.php.
- Verify in DevTools → Network → select HTML document → Response Headers.
How to fix missing permissions policy on PrestaShop
- Apache: Edit your .htaccess or virtual host config in the PrestaShop root. Add the Header set directive inside <IfModule mod_headers.c> (see Apache snippet).
- Nginx: Add the add_header directive in the server {} block of your PrestaShop nginx config.
- Module approach: Search PrestaShop Addons marketplace for a 'security headers' module, install it, and configure the Permissions-Policy header value.
- Verify in DevTools → Network → Response Headers.
How to fix missing permissions policy on OpenCart
- Apache: Edit the .htaccess file in the OpenCart web root or the Apache virtual host config. Add the Header set line inside <IfModule mod_headers.c>.
- Nginx: Add add_header to the server block in your Nginx site config.
- Verify in browser DevTools → Network → Response Headers.
How to fix missing permissions policy on Headless / Custom (I build in code)
- Node.js / Express: Use the 'helmet' npm package — call helmet.permittedCrossDomainPolicies() and manually set the header, or use the permissionsPolicy option. Alternatively: res.setHeader('Permissions-Policy', 'camera=(), microphone=(), geolocation=(), payment=(), usb=(), interest-cohort=()') in a global middleware.
- Next.js: Add the header in next.config.js under the headers() async function (see Next.js code snippet).
- Nuxt.js: Add the header in nuxt.config.js under routeRules or serverMiddleware, or via the Nitro server config.
- Apache / Nginx at origin: Use the config snippets below.
- CDN edge (Cloudflare Workers, Fastly, Vercel Edge): Inject the header in your edge function's response object.
- Verify with curl -I https://yourdomain.com | grep -i permissions-policy
How to fix missing permissions policy on Next.js
- Open next.config.js in your project root.
- Add or extend the `headers()` async function to return the Permissions-Policy header for all routes: async headers() { return [{ source: '/(.*)', headers: [{ key: 'Permissions-Policy', value: 'camera=(), microphone=(), geolocation=(), payment=(), usb=()' }] }] }
- Save the file and restart your Next.js server (npm run build && npm start for production).
- Verify with Chrome DevTools → Network → Response Headers.
Does your site have this issue?
Run a free SEOLZ scan to find missing permissions policy — and every other issue — across your whole site in minutes.
Scan my site freeFrequently asked questions
What is Missing permissions policy?
The Permissions-Policy header (formerly called Feature-Policy) is a short line of text your web server sends to every visitor's browser along with each page. It acts as a rulebook that tells the browser exactly which powerful device features — like the camera, microphone, GPS location, payment APIs, and more — your site is allowed to use, and which should be completely blocked. Without it, the browser applies its own default rules, and any third-party script or iframe embedded on your store could potentially request access to those features without your knowledge or consent.
Why does missing permissions policy matter?
Missing this header is flagged by OWASP as a Security Misconfiguration (A05:2021), meaning auditors, enterprise buyers, and PCI-DSS assessors will mark it as a finding that needs remediation. More practically: any malicious or compromised third-party script — an analytics tag, a chat widget, an ad pixel — could silently attempt to activate a shopper's camera or microphone; a Permissions-Policy header stops that cold. It also signals to Google and to privacy-conscious customers that your store follows security best practices, which protects conversion rates and brand trust. Some browser security warnings and privacy regulations (GDPR, CCPA) are increasingly tied to whether sites take proactive steps to limit unnecessary data collection capabilities.
How do I fix missing permissions policy?
Add a Permissions-Policy HTTP response header to your store to explicitly restrict which browser features (camera, microphone, geolocation, etc.) pages and embedded third-party scripts are allowed to access.
Authoritative references
- OWASP Top Ten — OWASP
- OWASP Cheat Sheet Series — OWASP
- Secure Headers Project — OWASP