securitywarning impacttier 1✓ verified99% confidence

Site missing Referrer-Policy header

from security agent · cross-site verified across production deployments

The trigger

Site missing Referrer-Policy header

The fix

Add a Referrer-Policy header to control how much referrer info leaks to other origins. strict-origin-when-cross-origin is the modern default.

Code example

Referrer-Policy: strict-origin-when-cross-origin

# Or, for stricter privacy on internal docs:
Referrer-Policy: same-origin

Related patterns

Does your site have this security issue?

Run a free scan — we'll check all security patterns in 30 seconds.

Scan your site free →