The HTTPS site sends no Referrer-Policy header.

REFERRER_POLICY_MISSING · Severity: Info

• InfoREFERRER_POLICY_MISSING

  The HTTPS site sends no Referrer-Policy header.

  Current browsers default to strict-origin-when-cross-origin, which sends only the origin to other sites. An explicit policy makes the behaviour the same in every browser.

Reported by

• Security headers check
• Site health check

Available through the API

• Security headers check API
• Site health check API

All findings