Missing Referrer-Policy: choose a value and add the header

Updated Oct 27, 2026 · Pewterkit Guides

"Missing Referrer-Policy" means your site doesn't say how much of its page address browsers may pass to other sites when visitors click a link or load a resource. Add Referrer-Policy: strict-origin-when-cross-origin (or a stricter value such as same-origin or no-referrer) as a response header, so private details in your URLs, like reset tokens or search terms, stay on your site.

What the header controls

MDN: Referrer-Policy "controls how much referrer information (sent with the Referer header) should be included with requests." When someone on https://yourapp.com/account/reset?token=abc clicks a link to another site, the policy decides whether that site sees the full address, only https://yourapp.com/, or nothing.

Common values, from MDN:

Value What other sites receive
no-referrer Nothing.
same-origin Nothing; your own pages still get the full address.
strict-origin Only your origin (on your own pages too), and nothing to plain-HTTP sites.
strict-origin-when-cross-origin Only your origin for other sites (HTTPS only); the full address on your own pages.
unsafe-url The full address everywhere. Avoid.

Why set it if browsers have a default

MDN says strict-origin-when-cross-origin "is the default policy if no policy is specified." So a missing header is a small risk in current browsers. Setting it anyway makes the behavior explicit for every browser, and lets you choose a stricter value if your URLs carry anything private. Security scanners also flag the missing header.

Add the header

Netlify or Cloudflare Pages (_headers file):

/*
  Referrer-Policy: strict-origin-when-cross-origin

Vercel (vercel.json):

{
  "headers": [
    {
      "source": "/(.*)",
      "headers": [{ "key": "Referrer-Policy", "value": "strict-origin-when-cross-origin" }]
    }
  ]
}

Test this on a preview deployment before relying on it. If you use analytics or affiliate programs that rely on the referrer, strict-origin-when-cross-origin keeps sending your origin, which is usually what they need.

What Pewterkit Check looks at

The check reads your home page's response headers for a Referrer-Policy header and reports a missing one together with the other basic browser protections (HSTS, clickjacking protection, nosniff) in one finding. It reads the HTTP header only: a <meta name="referrer"> tag also works in browsers but isn't counted, so use the header. It skips builder subdomains, where the platform controls the headers.

FAQ

Can I use a meta tag instead?

Browsers accept <meta name="referrer" content="strict-origin-when-cross-origin">, per MDN. A response header covers every page and file at once, so it's the simpler choice.

Which value is the strictest?

no-referrer, which sends nothing. same-origin is a good middle ground: other sites get nothing, your own analytics still see full paths.

Will it break sign-in or payments?

strict-origin-when-cross-origin matches what most browsers already do, so it changes nothing for them. With no-referrer, test sign-in and checkout flows once, since some providers read the referrer.

Sources

  1. Referrer-Policy header (MDN) — read 27 Oct 2026
  2. Custom headers (Netlify Docs) — read 27 Oct 2026
  3. Headers (Cloudflare Pages docs) — read 27 Oct 2026
  4. Static configuration with vercel.json: headers (Vercel Docs) — read 27 Oct 2026

How this page was made: drafted with AI from the sources listed, reviewed by Pewterkit. Docs checked Oct 27, 2026. Spotted something out of date? Tell us.

Related guides