Referrer-Policy headerWhat it checks and how to fix it

What it checks

Fetches the homepage and reads Referrer-Policy. A missing header fails. unsafe-url, or any value that is not a standard policy, gets a warning. A header made only of recognised values (such as strict-origin-when-cross-origin, same-origin or no-referrer) passes.

Why it matters

The Referer header tells every site you link to, and every third-party script, image and analytics call, which page the visitor came from. Full URLs can carry search terms, account IDs, password-reset tokens or other private data in their paths and query strings. A sensible policy sends only your origin to other sites, or nothing.

How to fix it

Set an explicit policy. strict-origin-when-cross-origin keeps full referrers on your own site and sends only the origin elsewhere (never over HTTP); no-referrer or same-origin are stricter.

nginx

add_header Referrer-Policy "strict-origin-when-cross-origin" always;

Apache

Header always set Referrer-Policy "strict-origin-when-cross-origin"

Cloudflare: Rules → Transform Rules → Modify Response Header → set Referrer-Policy to strict-origin-when-cross-origin.

Rails sends strict-origin-when-cross-origin by default; if it is missing, restore it in config/application.rb:

config.action_dispatch.default_headers["Referrer-Policy"] = "strict-origin-when-cross-origin"

Or in HTML: <meta name="referrer" content="strict-origin-when-cross-origin">.