Security
Stop leaking where your visitors came from
Your site does not set a referral policy, so full addresses of where visitors came from are passed to every external site they then visit.
Why it matters
When a visitor clicks a link to another site, your page address travels with them. If that address contains anything identifying or private, such as a search query or an account reference, the other site receives it. The policy is a one-line instruction on how much to share, and the sensible default shares the domain but nothing more. One value works against you rather than for you: unsafe-url sends the full page address to every destination, so this check rejects it. If you already publish unsafe-url, your header is present and still failing, and swapping it for one of the values above is the whole fix.
How you would notice it
- A privacy or security review flagged unprotected referrer leakage.
- Analytics show other sites receiving full paths from yours.
What to do
Stage 1
- Add the header in your web server or host configuration.
This is the modern default. It sends your full address for clicks within your own site and strips it to just your domain for other sites.
# nginx
add_header Referrer-Policy "strict-origin-when-cross-origin" always;Stage 2
- If you want maximum privacy and do not rely on referral data, use a stricter value.
This means other sites see no referrer at all. It also means you will not see referrers from partners who link to you.
# nginx
add_header Referrer-Policy "no-referrer" always;Stage 3
- If you cannot edit server headers, the same policy can be set per page in the head section.
<meta name="referrer" content="strict-origin-when-cross-origin">How to check it worked
Confirm it worked
Check your response headers and confirm referrer-policy is present. Then click a link from your site to an external site and confirm in that site analytics, or a header inspector, that only your domain is reported and not the full page address. Re-run the Siege Test and confirm the Referrer-Policy recommendation is gone.