How to fix missing permissions policy on Adobe Commerce (Magento)

Steps for Adobe Commerce (Magento)

1. For Apache: Edit your virtual host config or the .htaccess in the Magento web root. Add the header inside a <IfModule mod_headers.c> block (see code snippet).
2. For Nginx: Edit your Magento nginx.conf or the site-specific config file. Add the add_header line inside the server {} block (see code snippet). Run 'nginx -s reload'.
3. Alternatively, create a custom module or plugin: create a custom HTTP response plugin in app/code/YourVendor/SecurityHeaders/Plugin/ResponsePlugin.php that calls $response->setHeader('Permissions-Policy', 'camera=(), microphone=(), geolocation=(), payment=(), usb=(), interest-cohort=()'); in an aroundSendResponse method.
4. If using Cloudflare or Fastly CDN in front of Magento: add the header via a Cloudflare Transform Rule or Fastly VCL snippet for the simplest approach.
5. Run 'php bin/magento cache:flush' after any code change, then verify in DevTools.

What is missing permissions policy?

The Permissions-Policy header (formerly called Feature-Policy) is a short line of text your web server sends to every visitor's browser along with each page. It acts as a rulebook that tells the browser exactly which powerful device features — like the camera, microphone, GPS location, payment APIs, and more — your site is allowed to use, and which should be completely blocked. Without it, the browser applies its own default rules, and any third-party script or iframe embedded on your store could potentially request access to those features without your knowledge or consent.

Missing this header is flagged by OWASP as a Security Misconfiguration (A05:2021), meaning auditors, enterprise buyers, and PCI-DSS assessors will mark it as a finding that needs remediation. More practically: any malicious or compromised third-party script — an analytics tag, a chat widget, an ad pixel — could silently attempt to activate a shopper's camera or microphone; a Permissions-Policy header stops that cold. It also signals to Google and to privacy-conscious customers that your store follows security best practices, which protects conversion rates and brand trust. Some browser security warnings and privacy regulations (GDPR, CCPA) are increasingly tied to whether sites take proactive steps to limit unnecessary data collection capabilities.

See the complete Missing permissions policy guide for every platform and the full background.