Every check ยท Headers
Referrer policy
What it checks
Referrer-Policy, for values that leak full addresses.
Why it matters
Full addresses can hold private details, such as search terms or tokens, that other sites shouldn't see.
How to fix it
- Send strict-origin-when-cross-origin, or leave the header out for browsers' default, which is the same.
Referrer-Policy: strict-origin-when-cross-originCheck a site for this and everything else: snag.page. More on headers: Bot challenge Content-Security-Policy Framing nosniff Software versions End-of-life software CORS Permissions-Policy Cross-Origin-Opener-Policy