How do I fix a missing Referrer-Policy header?

A missing Referrer-Policy header leaves how much referrer information your pages send to other origins up to the browser default rather than an explicit choice. The Referrer-Policy response header controls how much referrer information, sent in the Referer header, is included with requests. The fix is to set an explicit policy that matches your privacy requirements.

Why this matters

The Referer header can expose full URLs, including query strings that may contain tokens, identifiers, or search terms, to any site your links, images, or third-party scripts contact. MDN notes that if no policy is specified, or the provided value is invalid, browsers apply strict-origin-when-cross-origin by default, which sends only the origin cross-origin but the full path and query for same-origin requests. Relying on that default is fragile, because the default itself changed, from no-referrer-when-downgrade, and because the policy also affects whether the Origin header is set to null on some form submissions and fetch calls. The unsafe-url value explicitly leaks potentially private information from HTTPS resources to insecure origins and should not be used. Choosing a policy deliberately also documents intent, so a reviewer can see that a deliberate decision was made rather than an accidental omission. Referrer leakage is subtle because it happens silently on every outbound navigation and on every third-party subresource a page loads, including scripts, images, and fonts. A URL that carries a session token, an email address, or an internal identifier in its query string can end up recorded in another party's logs, so the policy you choose is effectively a data-sharing decision and not only a privacy toggle.

How to fix it

Pick one policy and send it on all responses. no-referrer sends nothing; strict-origin sends only the origin and never to a less secure destination; strict-origin-when-cross-origin sends the full URL for same-origin requests and only the origin cross-origin. The examples set strict-origin-when-cross-origin through Nginx add_header, Apache Header always set, Express res.set and Helmet, the Next.js headers function, a Cloudflare Pages _headers file, and a Cloudflare Worker Response. You can also set a policy in HTML with a meta element named referrer, but a response header is more reliable because it covers responses that HTML markup cannot reach, such as assets and redirects.

# Nginx
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

# Apache
Header always set Referrer-Policy "strict-origin-when-cross-origin"

// Express (Helmet defaults to no-referrer)
app.use(helmet());

// next.config.js
module.exports = {
  async headers() {
    return [
      {
        source: '/:path*',
        headers: [ { key: 'Referrer-Policy', value: 'origin-when-cross-origin' } ],
      },
    ]
  },
}

# Cloudflare Pages public/_headers
/*
  Referrer-Policy: no-referrer

// Cloudflare Workers
export default {
  async fetch() {
    return new Response('ok', {
      headers: { 'Referrer-Policy': 'strict-origin-when-cross-origin' },
    });
  },
};

How to verify the fix

Confirm the header on your document responses with the curl command below or with DevTools under Network. Then follow an outbound link to a different origin and inspect the outgoing Referer value in the request headers, adjusting the policy until what is sent matches your intent. Remember that a stylesheet's own Referer header follows the policy on that stylesheet response, so set the policy globally rather than only on HTML.

curl -sI https://example.com/ | grep -i referrer-policy

Automated check

The Auditor inspects your response headers and reports the absent header as a Missing Referrer-Policy header finding at Low severity. It checks for presence only; it does not judge which policy value is appropriate for your application. Because the severity is Low, it is often fixed alongside the higher-priority header findings in the same response.

Scan your app free →

Related issues