A referrer policy is missing or sends full addresses
In the reportReferrer-Policy absent or leaks full URLs cross-origin
referrer_policy_missing_or_unsafe · Issue
This security advice appears when a page declares a referrer policy that sends its full address to other sites, unsafe-url or no-referrer-when-downgrade, or declares no policy at all. The full address can carry private details, such as a search or a token in its query. Set Referrer-Policy: strict-origin-when-cross-origin or stricter.
Severity: Notice. Security advice in Good to know for both absence and a policy that can disclose full addresses. Modern browsers already use a restrictive default when no policy is declared; this check makes no ranking claim.
Why it matters
web.dev's guide to referrer policies explains that sending the full address, with its path and query, to other sites can endanger users' privacy, and strongly recommends setting an explicit privacy-enhancing policy such as strict-origin-when-cross-origin, so that the site behaves the same in every browser.
What to do
- Look at the finding: it shows the
Referrer-Policyheader and<meta name="referrer">values we read, and the policy that results. - Send
Referrer-Policy: strict-origin-when-cross-origin, orsame-originorno-referrerfor stricter pages. - Remove
unsafe-urlandno-referrer-when-downgradefrom the header and any meta tag; a recognised policy in a later meta tag can override the header.
When to leave it as it is: if the page declares no policy and you are content with the browsers' default, you can leave the notice; it is not a leak in current browsers.
What we read
We read the final response of each crawled HTML page with our own user agent: every Referrer-Policy header and a <meta name="referrer"> inside <head>. We use the last recognised value; a recognised meta value can override a header value.
A page is reported when the effective recognised policy is unsafe-url or no-referrer-when-downgrade, or when no policy is declared; both appear as advice. An unrecognised value is skipped if another recognised value remains; if declarations exist but none can be resolved, the check cannot conclude. A meta tag in <body> is ignored.
Example & evidence
Illustrative example — one response, not a live audit.
https://bakery.example/search?q=birthday+cake answers with:
Referrer-Policy: unsafe-urlUnder this declared policy, an eligible click to another site can send the full address, search included, so the page is reported.
Referrer-Policy: strict-origin-when-cross-originA possible correction: eligible cross-origin links then send at most https://bakery.example/.
Confirm & check again
Check for yourself: open the page's response headers and look for Referrer-Policy, and search the page source for name="referrer".
Check again: Full audit — run a new audit of the site. A complete HTML recheck clears this rule's finding when the page declares a recognised policy that does not send full addresses to other sites. With no declared policy the rule still reports a notice; with declarations but no recognised value it cannot conclude.
Limits & sources
The check reads the declared policy, not the Referer a browser actually sends, and ignores policies set on single links with referrerpolicy or rel="noreferrer".
Confidence: High because the header and the meta tag are read directly.
Sources
- web.dev, Referer and Referrer-Policy best practices — explains that sending the full address across origins can endanger user privacy, and strongly recommends an explicit privacy-enhancing policy such as strict-origin-when-cross-origin. Checked 28 September 2026.
Editorial review: 2 November 2026