webzod
account

Add a Permissions-Policy on nginx

headers.permissions.missing · effort: minutes

Why it matters

Without one, any script on your pages, including injected or third-party code, can ask visitors for the camera, microphone, location and similar features. Turning off what you do not use limits what such code can request.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

  1. Add the line to your shared security headers snippet (adjusted to the features you use), run sudo nginx -t and reload.
  2. Test the pages that use those features.
/etc/nginx/snippets/security-headers.conf 
add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=()" always;

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.