What is a referrer policy?
When a visitor clicks a link from your site to another, the browser tells the other site where the visitor came from. By default that can include the full address of the page they were on, which might contain a customer's order number, a search term or a private link. A referrer policy limits what is shared. For most business sites the right setting is "strict-origin-when-cross-origin", which shares only your domain, not the page.
Why it matters
Suppose a customer views their booking at yoursite.co.uk/booking/4821 and clicks a link to a map. Without a policy, the map provider learns that address. Analytics scripts, embedded widgets and every external link leak the same detail. It is a privacy matter under data protection law, and it also means competitors whose sites you link to can see exactly which of your pages sent the visitor.
The sensible setting
"strict-origin-when-cross-origin" is now the default in modern browsers and is what our check accepts. It sends the full address to pages on your own site, sends only the domain to other sites, and sends nothing when moving from https to http. Setting it explicitly makes the behaviour certain in every browser rather than relying on defaults.
How to check
Our check looks for the Referrer-Policy header on your home page. The same value can be set with a meta tag in the page head, which our check also accepts.
How to fix it
Add the header "Referrer-Policy: strict-origin-when-cross-origin". On Apache it is one line in the .htaccess file; most hosting panels and content delivery networks have a setting; WordPress security plugins offer it. It has no visible effect on the site and will not break analytics, which still see the visitor and the page within your own domain.
Not sure how your own site does on this? Run the free check: it takes about twenty seconds and reports on this and thirty other things.