webzod
account

Set a Referrer-Policy on nginx

headers.referrer.missing · effort: minutes

Why it matters

Without one, how much of your page addresses other sites receive depends on each browser's default. strict-origin-when-cross-origin sends only your domain to other sites and nothing over insecure connections.

The fix

  1. Add the line to your shared security headers snippet, include it where needed, run sudo nginx -t and reload.
/etc/nginx/snippets/security-headers.conf 
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.