How to fix missing permissions policy on Adobe Commerce (Magento)

Steps for Adobe Commerce (Magento)

1. For Apache-based deployments: edit your .htaccess file in the Magento root directory or your virtual host config and add: `Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=()"` — ensure mod_headers is enabled in Apache.
2. For Nginx-based deployments: add to your nginx.conf server {} block: `add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=()" always;` then run `nginx -t` to validate and `systemctl reload nginx`.
3. Alternatively, add the header programmatically via a custom Magento module: create a plugin on Magento\Framework\App\Response\Http that calls $response->setHeader('Permissions-Policy', 'camera=(), microphone=(), geolocation=()', true); in an afterSendResponse method.
4. If using Adobe Commerce Cloud, add the header in your .magento.app.yaml or via Fastly (the bundled CDN): Stores → Configuration → Advanced → System → Full Page Cache → Fastly Configuration → Custom VCL Snippets, or use Fastly's response header rules.
5. Flush the full-page cache after any change: System → Cache Management → Flush Magento Cache.
6. Verify with Chrome DevTools → Network → Response Headers.

Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), fullscreen=(self)

What is missing permissions policy?

The Permissions-Policy header (formerly called Feature-Policy) is a security instruction your web server sends to every visitor's browser. It acts like a bouncer's list for powerful browser features — it tells the browser exactly which features your site is allowed to use, and blocks everything else. For example, you can declare that your store never needs access to a visitor's camera, microphone, or precise location, so even if malicious code was somehow injected into your page, the browser would refuse to grant that access. Without this header, browsers apply loose default rules, leaving those features potentially available to any script running on your pages.

Missing this header is flagged under OWASP A05:2021 (Security Misconfiguration) — one of the most common vulnerability categories found on real sites. If third-party scripts (ad networks, chat widgets, analytics) or injected malicious code try to silently access a shopper's camera, microphone, or location, nothing at the browser level stops them without this header. For an ecommerce store, that is a direct privacy and trust risk: a single reported incident of covert data capture can destroy customer confidence and trigger GDPR/CCPA regulatory scrutiny. Adding this header is a low-effort, high-signal security hardening step that security auditors and increasingly Google's ranking systems look for as a mark of a trustworthy site.

See the complete Missing permissions policy guide for every platform and the full background.