AI Cyber Shield

How to add the Referrer-Policy header

When a visitor leaves your site for another, the browser can send that site the full address of the page, including anything in it. Referrer-Policy limits this to your site's name.

How to fix it, by platform

WordPress

Where: your theme's functions.php (or a snippets plugin)

add_action('send_headers', function () {
  header("Referrer-Policy: strict-origin-when-cross-origin");
});

WordPress sends the Referrer-Policy header on every page load.

How to confirm: Reload the site and check the response headers include `Referrer-Policy`.

Cloudflare

Where: Cloudflare dashboard → Rules → Transform Rules → Modify Response Header → Add

Set static  —  Header name: Referrer-Policy  —  Value: strict-origin-when-cross-origin

Cloudflare injects the Referrer-Policy header at the edge, no server change needed.

How to confirm: Reload the site and check the response headers include `Referrer-Policy`.

Vercel / Next.js

Where: next.config.js → async headers()

module.exports = {
  async headers() {
    return [{ source: "/(.*)", headers: [
      { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
    ]}];
  },
};

Next.js sets the Referrer-Policy header on every route.

How to confirm: Reload the site and check the response headers include `Referrer-Policy`.

Netlify

Where: a `_headers` file in your publish directory (or netlify.toml)

/*
  Referrer-Policy: strict-origin-when-cross-origin

Netlify applies the Referrer-Policy header to all paths (`/*`).

How to confirm: Reload the site and check the response headers include `Referrer-Policy`.

Nginx

Where: nginx.conf — inside your `server { }` block, then reload nginx

add_header Referrer-Policy "strict-origin-when-cross-origin" always;

Adds the Referrer-Policy header for every response.

How to confirm: Reload the site and check the response headers include `Referrer-Policy`.

Apache

Where: .htaccess (or the vhost config), then restart Apache

Header always set Referrer-Policy "strict-origin-when-cross-origin"

Adds the Referrer-Policy header via mod_headers.

How to confirm: Reload the site and check the response headers include `Referrer-Policy`.

IIS

Where: web.config — inside <system.webServer><httpProtocol><customHeaders>

<add name="Referrer-Policy" value="strict-origin-when-cross-origin" />

Adds the Referrer-Policy header in IIS.

How to confirm: Reload the site and check the response headers include `Referrer-Policy`.

Your web server

Where: your web server's response-header configuration

Referrer-Policy: strict-origin-when-cross-origin

Configure your server/CDN to send this header on all responses.

How to confirm: Reload the site and check the response headers include `Referrer-Policy`.

Not sure your site needs this fix? A scan checks this and dozens of other things and shows what yours is missing.

Scan your site free

Related guides