http.referrer_policy Reviewed July 2026

Quick fix

Remove secrets, credentials, and personal data from URLs wherever possible.

What this finding means

SecuTest accepts restrictive policies such as `strict-origin-when-cross-origin`, `same-origin`, `strict-origin`, or `no-referrer`. It warns when no policy is declared or the value may reveal more information than necessary.

Interpretation boundary Use the exact evidence in your report. SecuTest reports externally observable conditions; it does not assume ownership, exploitability, compromise, or business intent when those cannot be proven remotely.

Associated attack or threat scenario

Threat type Sensitive URL and navigation metadata leakage

How the attack or failure scenario works

Browsers may send the current page URL in the `Referer` header when navigating or loading third-party resources. If URLs contain identifiers, reset tokens, search terms, or internal paths, that information can leak to external sites and logs.

Conditions and limitations

  • A sensitive value appears in a URL or path.
  • The page loads or links to another origin.
  • The effective referrer policy permits the browser to send the sensitive portion.

Why it matters

Security and business impact A missing or permissive Referrer-Policy can disclose internal paths, query values, or origin information to third-party destinations.

Step-by-step fix

Where to make the change

  • The outermost component emitting the public HTTP response: CDN, reverse proxy, ingress, web server, or application middleware.
  • Apply the control consistently to normal pages, redirects, error responses, and relevant subdomains.

Remediation procedure

  1. Remove secrets, credentials, and personal data from URLs wherever possible.
  2. Choose `strict-origin-when-cross-origin` as a balanced baseline or a stricter policy for sensitive applications.
  3. Set the header consistently at the CDN, reverse proxy, or application middleware.
  4. Review third-party analytics, payment, support, and embedded resources for compatibility.

Commands and configuration examples

Replace example values with the hostname, selector, IP address, port, provider, or policy values shown in your SecuTest evidence. Review every example before production use.

Nginx
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

Apache
Header always set Referrer-Policy "strict-origin-when-cross-origin"

Strict option
Referrer-Policy: no-referrer

Verify the fix

  1. Run curl and inspect the `Referrer-Policy` header.
  2. Use browser developer tools to observe the actual `Referer` header on cross-origin requests.
  3. Test authentication, password reset, checkout, and document-viewing flows.
  4. Confirm sensitive query strings are not sent to external origins.
Confirm the externally visible result

After DNS, CDN, certificate, mail, or application propagation completes, run a fresh SecuTest scan and compare the new evidence with the original finding.

Re-scan your domain

Common mistakes

  • Putting reset tokens or API keys in URLs and relying only on the header.
  • Using `unsafe-url`, which sends the full URL broadly.
  • Setting a meta tag on some pages while API and error responses remain inconsistent.

Authoritative references