Home / Fix guides / Referrer-Policy

Set a Referrer-Policy so URLs don't leak to other sites

Low

The Referrer-Policy header controls how much of the current URL is sent to other sites when users click links or load third-party resources.

Why it matters

Password-reset links, invite tokens and record IDs in URLs can leak to analytics or external sites.

Quick fix

Add Referrer-Policy: strict-origin-when-cross-origin (or no-referrer).

Step by step

Add the header

# public/_headers (Netlify and Cloudflare Pages)
/*
  Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
  X-Frame-Options: DENY
  X-Content-Type-Options: nosniff
  Referrer-Policy: strict-origin-when-cross-origin
  Permissions-Policy: camera=(), microphone=(), geolocation=()

Prompt for your AI builder

Paste this into Lovable, Bolt, v0, Cursor or Replit, then review the changes before deploying.

Add the header Referrer-Policy: strict-origin-when-cross-origin to every response of my app.

References

MDN: Referrer-Policy

Check your app

Run a free scan