How this check works
This check only acts if your site already sends the Referrer-Policy header; if it is missing entirely, the headers scanner reports that. Scanaris reads the value and, if it contains unsafe-url or no-referrer-when-downgrade, opens a low-severity finding with the exact value. Any other value (strict-origin-when-cross-origin, no-referrer, same-origin, origin, strict-origin) passes. In other words, it does not measure whether you have the header, but whether the one you have leaks the full URL.
What the referrer is and what leaks
Every time a user clicks a link to another site, or your page loads an image or script from another domain, the browser sends the destination a Referer header with the URL of the page they came from. The referrer policy decides how much of that URL is sent. With unsafe-url, the full URL, path and parameters included, even if the destination is HTTP. With no-referrer-when-downgrade, the full URL to any HTTPS destination; it was the browsers' default until 2020, which is why it still lingers in many older configurations. What leaks are things like /dashboard/invoices/8841, /reset-password?token=..., /search?q=layoff or the identifier of a shared document: everything in the user's URL reaches ad networks, analytics services and any external site you link to.
How to fix it
The recommended value for almost any site:
Referrer-Policy: strict-origin-when-cross-originIt sends the full URL within your own domain (so your analytics keep working), only the origin (https://yourdomain.com) to other domains, and nothing if the destination is HTTP. It is the default in modern browsers, so setting it explicitly just pins what they already do. If you do not need anyone to know where the visitor came from, no-referrer is stricter still.
- Nuxt: in
routeRulesofnuxt.config, under the'/**'rule. - Next.js: in the
headers()function ofnext.config.js. - Vercel: in
vercel.json. Netlify: in_headers. - nginx:
add_header Referrer-Policy "strict-origin-when-cross-origin" always;. Apache:Header always set Referrer-Policy "strict-origin-when-cross-origin". - Express:
helmet.referrerPolicy({ policy: 'strict-origin-when-cross-origin' }).
If one specific link needs different behaviour (say an affiliate programme that requires the full referrer), adjust it on that link with the referrerpolicy attribute instead of loosening the policy for the whole site.
Check it is fixed
curl -sI https://yourdomain.com | grep -i referrer-policyIt should show strict-origin-when-cross-origin or no-referrer. Also make sure there is no <meta name="referrer"> tag in the HTML with a different value: the meta takes precedence over the header on that page.
Frequently asked questions
Will I lose data in Google Analytics or my stats tool?
No. Your own site's analytics are fed by the script you include, not by the referrer. What changes is what the sites you link to see: instead of the exact page they will see your domain. For your own internal pages, the full referrer is kept.
My site has no URLs with sensitive data.
Today. A password reset link, an order identifier or a search parameter show up as soon as the site grows. Setting the right policy costs one line and has no side effects.
Why was no-referrer-when-downgrade the default?
Because in the early years of the web the full referrer was considered useful and HTTPS was a minority. Chrome, Firefox and Safari changed the default to strict-origin-when-cross-origin between 2020 and 2021 precisely because of the leaks this guide describes. All the related headers are explained in HTTP headers for humans.