Weak Referrer-Policy Scanner
Detects a permissive Referrer-Policy that leaks your site's full URL to external destinations.
What it checks
This scanner detects whether your site has a permissive Referrer-Policy that leaks the full URL to external sites. It identifies when the browser sends detailed addresses from your site when visiting links or loading third-party resources.
Why it matters
The full URL can contain sensitive information such as session identifiers, tokens or private paths that you would not want to share with other sites. A permissive policy sends that data to external destinations every time a user leaves your site.
How to fix it
Set the Referrer-Policy header to a stricter value like strict-origin-when-cross-origin, which shares only the origin and not the full path with external sites. It is defined in your server or CDN configuration and is usually a simple, safe change.
Check it on your site
Scan your site free and see if this and 44 other checks pass, with a fix prompt for every issue.
Scan my site free