Missing or leaky Referrer-Policy

Why it matters

Full URLs, including paths and query strings that may contain identifiers, are sent to every third party your pages link to or load.

How to fix it

Send Referrer-Policy: strict-origin-when-cross-origin (or stricter).

Related security checks

• Content-Security-Policy is too permissive
• Forms submitted over plain HTTP
• HTTP does not redirect to HTTPS
• Missing or weak Strict-Transport-Security