webzod
account

Stop sending full URLs to other sites on Shopify

headers.referrer.leaky · effort: minutes

Why it matters

unsafe-url sends the full address of the page, including path and query string, to every site it links to or loads from, and no-referrer-when-downgrade does the same for every https site. Those addresses can carry search terms, account IDs or reset tokens.

The fix

  1. If the value comes from a meta name=referrer tag in your theme, open Online Store, Themes, Edit code, and change it in layout/theme.liquid as below.
  2. If it comes from the response header, Shopify sets it and the store cannot change it.
layout/theme.liquid 
<meta name="referrer" content="strict-origin-when-cross-origin">

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.