When someone clicks a link on your site to visit another website, the browser automatically tells that other site which page the visitor came from. The Referrer-Policy header controls how much of that information is shared. This header is currently missing.
Why this matters
Without a Referrer-Policy, outbound links from your site send the full page URL - including any sensitive path segments or query parameters - to every external site your visitors navigate to. This can leak internal page names, tracking parameters, or session tokens.
How to fix it
Add the response header Referrer-Policy: strict-origin-when-cross-origin to your site. This is the modern recommended default and shares only your domain name (not the full URL) with external sites.
Turn website findings into an action plan
Create an account to start a Full Audit of your website, with supporting evidence and a prioritised action plan.