Matan · Security · Headers

Referrer-Policy

Controls how much of the URL is sent in the Referer header to others.

Pass condition in our engine: A Referrer-Policy header is present.

1. Problem description

The default can leak path and query (tokens, search terms) to third-party scripts and links. strict-origin-when-cross-origin is a solid default.

2. Most common causes

  • No policy set; browser default applies.
  • unsafe-url used for analytics convenience.

3. How to fix it

  1. Send Referrer-Policy: strict-origin-when-cross-origin (or stricter).
  2. Avoid unsafe-url.

Test this check

We fetch only this URL (plus robots.txt / llms.txt at the domain root when the check needs them). We do not crawl the rest of the site like a full report.

Scoring rules for the full site crawl are documented in methodology. Want every category at once? Generate a free report.

Get your free SEO & GEO report

Enter your URL and receive a full audit with scoring and recommendations. No sign-up required.

Generate a free reportView sample report