Optional hardening

Your site does not say how much of your page address to share with other sites

What it means

When a visitor clicks a link on your site, or your page loads something from another site, the browser tells that other site where the visitor came from. This is called the referrer.

The referrer can be just your domain, such as https://example.com/, or the full address, such as https://example.com/order/12345?email=jane@example.com. The Referrer-Policy header tells browsers which one to send, and when.

Your site does not send this header, so each browser uses its own default. Chrome, Edge, Firefox and Safari now default to sending only your domain to other sites, and the full address only within your own site. That is the same as the recommended setting.

Why it matters

Page addresses sometimes carry private details: an order number, a search term, a name or email address from a form, or a password reset link. If the full address is sent to another site, that detail goes with it.

Because current browsers already trim the address by default, the real-world gain from adding the header is small. It locks the behavior in for older browsers and makes your choice explicit instead of relying on defaults that could change.

That is why EverThread rates this as optional. It is worth doing if you are already changing headers, especially if your page addresses ever contain customer details. It is not worth losing sleep over.

How to check your own site

1. Open your home page in Chrome, Edge or Firefox. Right-click the page, choose Inspect, and open the Network tab.
2. Reload the page. Click the first row in the list, which is the page itself, and look at the Response Headers section.
3. Look for referrer-policy. If it is not there, the header is missing and browsers are using their defaults.

How to fix it

Any website

1. Use Referrer-Policy: strict-origin-when-cross-origin. Links within your own site keep the full address, so your own analytics still work. Other sites see only your domain. Nothing is sent from a secure page to a plain http page.
2. If you want to share even less, same-origin sends nothing at all to other sites. Partners and affiliate programs you link to will then no longer see that visitors came from you, so check that first.
3. Avoid unsafe-url and no-referrer-when-downgrade. Both send your full page address to other sites.

WordPress

1. Headers are usually best set at the server or CDN, not inside WordPress.
2. Check your host's dashboard for a security headers setting. Names vary by host.
3. If your host runs Apache, add the lines from the Apache section below to the .htaccess file in your site's main folder.
4. A plugin is the fallback. Search the plugin directory for "security headers" and pick one that is actively maintained.

Shopify, Squarespace, Wix and other hosted builders

1. These platforms run the servers, so you usually cannot add custom headers.
2. Referrer-Policy is one of the few settings that also works as a tag on the page. If your platform lets you add code to the page head, add the tag below. In Shopify this is the theme.liquid file under Edit code. In Squarespace it is Code Injection. In Wix it is Custom Code. Menu names and plan requirements vary.
3. The tag protects your visitors the same way, but it is not a header, so EverThread will keep listing the header as missing. Since this is optional, that is fine to leave.

<meta name="referrer" content="strict-origin-when-cross-origin">

Cloudflare

1. Go to Rules and create a response header rule. Depending on your dashboard, this is under Transform Rules, then Modify Response Header, or under Rules, Overview, as a Response Header Transform Rule.
2. Apply it to all incoming requests. Choose Set static, enter Referrer-Policy as the header name and strict-origin-when-cross-origin as the value, then deploy.
3. Rules only apply to traffic that goes through Cloudflare, shown as an orange cloud in your DNS settings.

Apache (.htaccess)

1. Add these lines to the .htaccess file in your site's main folder, or to your server's site settings. This needs the mod_headers module, which most hosts have on.

<IfModule mod_headers.c>
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

Nginx

1. Add this line inside your site's server block, then reload Nginx.

add_header Referrer-Policy "strict-origin-when-cross-origin" always;

What to send your developer

Send Referrer-Policy: strict-origin-when-cross-origin on HTML responses. It matches the modern browser default, so it is a low-risk change that pins the behavior. Individual links can override it with rel="noreferrer" or a referrerpolicy attribute, which is useful for links from pages whose URLs carry tokens, such as password resets. Better still, keep personal data out of URLs entirely and use POST for forms that carry it. The same policy works in a <meta name="referrer"> tag when headers cannot be set. See MDN on Referrer-Policy.

Referrer-Policy: strict-origin-when-cross-origin

Common questions