Referrer-Policy missing

Markdown-backed fix guides for Amhost Labs audit findings.

What is it?

Referrer-Policy is an HTTP response header that controls how much URL information the browser sends in the Referer header when a user navigates away from the site.

Why does it matter?

Without a policy, browsers may send more URL context than intended to external sites. That can leak paths, query parameters, campaign data, or identifiers embedded in URLs.

How to fix it?

Use a privacy-preserving default that still keeps useful origin-level analytics.

Referrer-Policy: strict-origin-when-cross-origin

For stricter privacy, consider no-referrer. Before changing the policy, check analytics, payment, SSO, and partner flows that may depend on referrer data.