Missing Referrer-Policy header

What it is

Without a Referrer-Policy header, the full URL of the page a visitor was on (which can include private details like search terms or an internal path) may leak to any third-party site your page links to.

How to fix it

Add a Referrer-Policy header, e.g. strict-origin-when-cross-origin. If you're not sure how, install the WordPress Plugin: its Security tab applies fixes like this one automatically.