Set a Referrer-Policy

headers.referrer.missing · effort: minutes

Why it matters

Without one, how much of your page addresses other sites receive depends on each browser's default. strict-origin-when-cross-origin sends only your domain to other sites and nothing over insecure connections.

The fix

Send the header below on every page.

http

Referrer-Policy: strict-origin-when-cross-origin

Read the documentation (opens in a new tab)

Reported by the Referrer-Policy check
Set a valid Referrer-Policy
Stop sending full URLs to other sites

Scan your domain to see whether this applies to you.

Why it matters

The fix

Related