When someone clicks a link on your site that leads to another website, their browser normally tells that other site which page they came from. Without a Referrer-Policy header, the browser sends your full page address — including anything after the ? in the URL, which can contain search terms, session details, or personal information. A Referrer-Policy header lets you control how much of that address gets shared.
Why it matters
Full URLs can leak private or sensitive details to advertisers, analytics services, and any external link your visitors follow. This is a privacy risk for your users and can expose parts of your site you'd rather keep quiet. Setting a sensible policy closes that gap without breaking normal linking.
How to fix it
A widely recommended value is strict-origin-when-cross-origin, which sends the full address within your own site but only the domain name to external sites.
WordPress
Add this to your active theme's functions.php file (or use a headers plugin):
add_action('send_headers', function () {
header('Referrer-Policy: strict-origin-when-cross-origin');
});
Nginx
Inside the relevant server block:
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
Then reload: sudo nginx -s reload
Apache
In your .htaccess file or virtual host config (requires mod_headers):
Header always set Referrer-Policy "strict-origin-when-cross-origin"
Cloudflare
Go to Rules → Transform Rules → Modify Response Header, add a rule that Sets a header named Referrer-Policy with the value strict-origin-when-cross-origin, and deploy it.
How to check it worked
Open your browser's developer tools, reload a page, and look at the response headers for the main document — you should see Referrer-Policy: strict-origin-when-cross-origin listed.