Set a Referrer-Policy

Web headers · about 5 min

In plain words

When visitors click a link to another site, the browser can send the full address of the page they came from — including tokens or search terms in the URL.

What can go wrong

Password-reset tokens, internal paths or personal data in URLs can leak to third parties.

How to fix it

Pick the platform your site runs on. Not sure? Forward this page to whoever manages your website.

Nginx

# inside the server { } block
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

Apache / .htaccess

<IfModule mod_headers.c>
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

Cloudflare

Rules → Transform Rules → Modify Response Header
  Set static: Referrer-Policy = strict-origin-when-cross-origin

# Cloudflare Pages: add to public/_headers
/*
  Referrer-Policy: strict-origin-when-cross-origin

Vercel

// vercel.json
{ "headers": [ { "source": "/(.*)", "headers": [
  { "key": "Referrer-Policy", "value": "strict-origin-when-cross-origin" }
] } ] }

Netlify

# public/_headers
/*
  Referrer-Policy: strict-origin-when-cross-origin

WordPress

// functions.php (child theme) — or use your security plugin's "HTTP headers" setting
add_action('send_headers', function () {
  header('Referrer-Policy: strict-origin-when-cross-origin');
});

Check that it worked

Re-run the ProbeHunt check.

Re-run the free check

References

MDN: Referrer-Policy