Optional hardening

Your site tells other websites which of your pages people came from

This is the exact wording EverThread uses when it finds this on a customer's site, written for someone who runs a business, not a server. The example site here is yourbakery.com.

What we saw

The Referrer-Policy header is missing, so the full address of your page is sent along when a visitor clicks out.

Why it matters

Page addresses sometimes carry order numbers, names or search terms. Those leak to whatever site the visitor lands on.

How to fix it

Send the technical line below to whoever runs your site. Each of these is a one-line change in the server or hosting settings, and none of them changes how the site looks.

For your developer