What it is

Without a Referrer-Policy header, the full URL of the page a visitor was on (which can include private details like search terms or an internal path) may leak to any third-party site your page links to.

How to fix it

Add a Referrer-Policy header, e.g. strict-origin-when-cross-origin. If you're not sure how, install the WordPress Plugin: its Security tab applies fixes like this one automatically.

In depth

When someone visits your website and then clicks a link to go to another site, your web server can accidentally tell that other site exactly what page they were on. This matters because your page URLs might contain sensitive information like search terms people used, account numbers, or internal file paths that you don't want shared with outsiders. Think of it like leaving a note visible to strangers showing where someone came from in your building. The fix is straightforward: you add a small instruction called a Referrer-Policy header that tells browsers to be more careful about sharing this information with external sites. If you're using WordPress, the easiest approach is to install a reputable security plugin like Wordfence or All In One WP Security, which has a settings tab where you can enable this protection with a single click, rather than editing server files yourself. Once enabled, browsers will limit what information gets shared while still letting your site function normally.