Missing Referrer-Policy header

LowAuto-fixableSecurityPer-page checksecurity_no_referrer_policy

What this means

The response sends no Referrer-Policy, so full URLs — including any sensitive query parameters — can leak to third-party sites in the Referer header.

How to fix it

Send Referrer-Policy: strict-origin-when-cross-origin.

Fix effort

This check is auto-fixable: the change can be written and validated automatically, so CrawlX can open it as a pull request for review.

Authoritative source

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers

Related checks

More in Security

Redirect downgrades HTTPS to HTTP Mixed content on an HTTPS page Content-Security-Policy is report-only Missing Content-Security-Policy header Missing HSTS header All checks

Find every page this affects

CrawlX runs this check — and 161 others — across your whole site, ranks the findings by estimated impact, and opens the fixable ones as pull requests. Free for 500 URLs.

Start crawling free Browse all checks