Skip to main content
SlapMyWeb
Slap a site

Security fix

How to Add a Referrer-Policy Header

Control how much referrer information your site leaks to other sites.

Difficulty
Easy
Impact
Medium
Time
5 min

Before

# No Referrer-Policy → full URL leaked cross-origin

After

Referrer-Policy: strict-origin-when-cross-origin
Before and after code for: How to Add a Referrer-Policy Header

Without a Referrer-Policy, browsers can send the full URL of your page, including paths and query strings, to every site a visitor clicks through to. Send the header Referrer-Policy: strict-origin-when-cross-origin. Other sites then see only your domain, while your own analytics still receive full referrer data.

How common is this?

Across every site SlapMyWeb has audited, 27.6% set a Referrer-Policy, which leaves 72.4% with no Referrer-Policy.

27.6%72.4%

Measured from SlapMyWeb audits of live public URLs. The full aggregate is published as a CC-BY-4.0 dataset.

Why it matters

By default, browsers may send the full URL (including paths and query strings that can contain sensitive data) to other sites when users click outbound links. A Referrer-Policy limits that leakage while keeping useful analytics referrer data.

How to fix it

  1. Choose a sensible policy

    strict-origin-when-cross-origin is the recommended default: full URL same-origin, only the origin cross-origin, nothing on downgrade.

  2. Send the header

    Add it as a response header site-wide.

The code

Beforehttp
# No Referrer-Policy → full URL leaked cross-origin
Afterhttp
Referrer-Policy: strict-origin-when-cross-origin

On your platform

WordPress

Add via a security-headers plugin or .htaccess.

Next.js

Add under headers() in next.config.js.

Sources

Check your site with our free tool

HTTP Header Checker

More fixes

Security

How to Add X-Content-Type-Options: nosniff

Stop browsers from MIME-sniffing responses: a one-line header that closes an XSS vector.

Security

How to Add a Permissions-Policy Header

Restrict which browser features (camera, mic, geolocation) the page and its iframes can use.

Security

How to Secure Cookies (Secure, HttpOnly, SameSite)

Add the flags that stop cookies being stolen over HTTP, via XSS, or in CSRF attacks.

Fixed that one.
Now find the rest.

A free audit ranks every issue on your site by the score points it costs, and links each one straight to its guide.

Run a free audit
Free foreverNo signupLive scan progress
How to Add a Referrer-Policy Header — Fix Guide | SlapMyWeb