webzod
account

Set a Referrer-Policy on Cloudflare

headers.referrer.missing · effort: minutes

Why it matters

Without one, how much of your page addresses other sites receive depends on each browser's default. strict-origin-when-cross-origin sends only your domain to other sites and nothing over insecure connections.

The fix

  1. Create a Response Header Transform Rule (Rules, Overview, Create rule) with Set static, header Referrer-Policy, value strict-origin-when-cross-origin. The Add security headers Managed Transform sets the stricter same-origin instead, which hides your domain from other sites entirely.

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.