Stop sending full URLs to other sites on Netlify
Why it matters
unsafe-url sends the full address of the page, including path and query string, to every site it links to or loads from, and no-referrer-when-downgrade does the same for every https site. Those addresses can carry search terms, account IDs or reset tokens.
The fix
- Change the Referrer-Policy value in _headers or netlify.toml to strict-origin-when-cross-origin and redeploy.
Related
Scan your domain to see whether this applies to you.