Security headers

Limit page addresses shared with other sites

Why this matters

When someone follows a link, their browser can send the address of the page they came from. A referrer policy limits how much of that address is shared.

What to do

1. Find the response header settings with your host. Response headers are instructions sent by your server with each page.
2. Set Referrer-Policy: strict-origin-when-cross-origin. For links to another secure site, this shares your site's main address rather than the full page address.
3. What to tell your web developer: Please add Referrer-Policy: strict-origin-when-cross-origin to the site's responses and check the live homepage receives it.

How to check the fix

Run the checker again and look for a pass for the referrer policy. A developer can check the exact header value in the browser's network tools.