Fix Guide

How to Add a Referrer-Policy Header

Control how much referrer information your site leaks to other sites.

Easy Medium Impact 5 min

Why It Matters

By default, browsers may send the full URL (including paths and query strings that can contain sensitive data) to other sites when users click outbound links. A Referrer-Policy limits that leakage while keeping useful analytics referrer data.

How to Fix

Choose a sensible policy

strict-origin-when-cross-origin is the recommended default — full URL same-origin, only the origin cross-origin, nothing on downgrade.

Send the header

Add it as a response header site-wide.

Code Fix

http

Before (broken)

# No Referrer-Policy → full URL leaked cross-origin

After (fixed)

Referrer-Policy: strict-origin-when-cross-origin

Platform-Specific Instructions

WordPress

Add via a security-headers plugin or .htaccess.

Next.js

Add under headers() in next.config.js.

Check with our tool

HTTP Header Checker

Want to find all issues at once?

Run a free audit and get a prioritized fix list with auto-generated code.

Run a free audit

How to Add a Referrer-Policy Header — Fix Guide | SlapMyWeb