Missing referrer policy
Quick winAdd a `Referrer-Policy: strict-origin-when-cross-origin` HTTP response header to every page so browsers control what referrer information is sent with requests.
What it is
When a visitor clicks a link or a browser makes a request from your store, it can automatically send a "Referer" header telling the destination site exactly which URL the user came from. The `Referrer-Policy` HTTP header lets you tell browsers how much of that URL to share — the full path, just your domain, or nothing at all. Without this header, browsers fall back to their own default behaviour, which can vary and may expose sensitive URL details (like search query strings, product IDs in cart URLs, or private discount codes) to third-party sites and analytics tools. Setting `Referrer-Policy: strict-origin-when-cross-origin` is the modern recommended default: it sends the full URL for same-site requests (useful for your own analytics) but only your domain name — never the full path — when linking to external sites.
Why it matters
Without a `Referrer-Policy` header, sensitive information embedded in your URLs — customer emails, session tokens, promo codes, or internal admin paths — can silently leak to every third-party resource your pages load (ad networks, CDN scripts, fonts, etc.). This is classified under OWASP A05:2021 Security Misconfiguration because it is a straightforward server setting that is simply missing. Beyond privacy and security exposure, Google's guidelines and security-focused ranking signals increasingly reward sites that demonstrate responsible data handling; a missing header also appears as a finding in security audits and PCI-DSS scans that payment processors may require you to pass. Fixing it takes under 30 minutes on most platforms and immediately closes the information-leakage risk for all visitors.
How to fix it
- Decide on the policy value — `strict-origin-when-cross-origin` is the recommended safe default for most stores: it sends the full URL to same-origin requests and only the origin (domain) to cross-origin requests, and nothing over HTTP.
- Add the header at the web-server or platform level so it is returned on every HTTP response, not just HTML pages — CSS, JS, image, and API responses should all carry it.
- If your platform does not allow arbitrary HTTP headers, use an HTML `<meta>` tag as a fallback: `<meta name="referrer" content="strict-origin-when-cross-origin">` placed inside `<head>` on every page template.
- Verify the header is present by opening your browser's DevTools (Network tab), reloading a page, clicking the document request, and checking the Response Headers section for `referrer-policy`.
- Confirm with a free online header-checker tool (e.g. securityheaders.com) that the header is returned and set to the correct value.
- Test your site's analytics and affiliate/referral tracking still work correctly — the recommended policy preserves referrer data for same-origin navigation and passes the origin to trusted cross-origin partners.
<meta name="referrer" content="strict-origin-when-cross-origin">
<!-- OR as an HTTP response header (preferred): -->
Referrer-Policy: strict-origin-when-cross-originFix it on your platform
Pick your platform for the exact steps.
How to fix missing referrer policy on Shopify
- Shopify's hosted infrastructure does not let you set arbitrary HTTP response headers via the admin UI directly.
- The most practical approach is to inject the `<meta>` tag fallback: go to Online Store → Themes → Actions → Edit Code.
- Open `layout/theme.liquid` and add `<meta name="referrer" content="strict-origin-when-cross-origin">` immediately after the opening `<head>` tag.
- Save the file. Verify using browser DevTools → Network → select document → Response Headers (note: the meta tag approach controls browser behaviour even though it won't show as an HTTP header in DevTools; for the true HTTP header you need a Shopify Plus account with a custom edge/CDN layer or a reverse proxy like Cloudflare — see the Cloudflare step below).
- Shopify Plus stores using Cloudflare (or another CDN/WAF): add a Transform Rule or HTTP Response Header Rule to inject `Referrer-Policy: strict-origin-when-cross-origin` on all responses.
How to fix missing referrer policy on Shopify Plus
- Use a Cloudflare (or similar CDN/WAF) HTTP Response Header Transform Rule to add `Referrer-Policy: strict-origin-when-cross-origin` to every response — this is the only way to set a true HTTP header on Shopify Plus storefronts.
- In Cloudflare: Rules → Transform Rules → Modify Response Header → Add Header → Name: `Referrer-Policy`, Value: `strict-origin-when-cross-origin`, apply to hostname matches your store domain.
- As a belt-and-suspenders measure, also add the `<meta>` tag to `layout/theme.liquid` as described for standard Shopify above.
How to fix missing referrer policy on WooCommerce
- WooCommerce runs on WordPress/Apache or Nginx, so you set this at the server level.
- Apache: open your `.htaccess` file (in the WordPress root) and add inside the `<IfModule mod_headers.c>` block: `Header always set Referrer-Policy "strict-origin-when-cross-origin"`
- Nginx: open your server block config (e.g. `/etc/nginx/sites-available/yoursite.conf`) and add inside the `server {}` block: `add_header Referrer-Policy "strict-origin-when-cross-origin" always;` — then run `nginx -t` and reload.
- Alternatively, install the free WordPress plugin **Headers Security Advanced & HSTS WP** (or **Security Headers** plugin): go to WP Admin → Plugins → Add New, search for the plugin, install and activate, then enable `Referrer-Policy` and select `strict-origin-when-cross-origin` from the dropdown.
- Verify with browser DevTools or securityheaders.com.
How to fix missing referrer policy on WordPress.org
- Install a security-headers plugin such as **Headers Security Advanced & HSTS WP** or **WP Headers** from WP Admin → Plugins → Add New.
- Activate the plugin, navigate to its settings page, find the Referrer-Policy option, and set it to `strict-origin-when-cross-origin`.
- Alternatively, add the header directly in `.htaccess` (Apache) or your Nginx server block config as described in the WooCommerce steps above.
- Verify with browser DevTools → Network tab → document response headers.
How to fix missing referrer policy on BigCommerce
- BigCommerce's SaaS infrastructure does not expose raw HTTP response header configuration in the standard control panel.
- Inject the meta-tag fallback: go to Storefront → Themes → Advanced → Edit Theme Files → open `templates/layout/base.html` (or your active layout file).
- Add `<meta name="referrer" content="strict-origin-when-cross-origin">` immediately after `<head>`.
- Save and apply. For a true HTTP header, route your storefront behind Cloudflare and use a Transform Rule (Modify Response Header) to add `Referrer-Policy: strict-origin-when-cross-origin` on all responses.
How to fix missing referrer policy on Wix
- Wix does not allow custom HTTP response headers to be configured through its editor or dashboard.
- As a partial mitigation, use Wix's **Velo (Welo Dev Mode)** to inject a meta tag: enable Dev Mode in the editor, open the `<head>` section via Site → SEO & Meta Tags → Additional Tags, and add: `<meta name="referrer" content="strict-origin-when-cross-origin">`.
- For a true HTTP-level header, you would need to proxy your Wix site through a service like Cloudflare and inject the header there via a Transform / Page Rule.
- Verify the meta tag is present in page source (View Source → search for 'referrer').
How to fix missing referrer policy on Wix eCommerce
- Follow the same steps as standard Wix above — Wix eCommerce shares the same infrastructure and header-injection limitations.
- Add the meta tag via Site → SEO & Meta Tags → Additional Tags: `<meta name="referrer" content="strict-origin-when-cross-origin">`.
- Use Cloudflare as a proxy with a Modify Response Header rule for the true HTTP header.
How to fix missing referrer policy on Squarespace
- Squarespace does not expose HTTP response header configuration in its admin panel.
- Inject the meta tag via Website → Pages → select any page → Page Settings → Advanced → Header Code injection (available on Business plan and above): add `<meta name="referrer" content="strict-origin-when-cross-origin">`.
- For site-wide injection, use Settings → Advanced → Code Injection → Header section to add the same meta tag once for all pages.
- For a true HTTP header, proxy through Cloudflare and add a Modify Response Header Transform Rule.
How to fix missing referrer policy on Squarespace Commerce
- Same as Squarespace above — use Settings → Advanced → Code Injection → Header to add the meta tag site-wide: `<meta name="referrer" content="strict-origin-when-cross-origin">`.
- Cloudflare proxy + Modify Response Header rule is required for the real HTTP header.
How to fix missing referrer policy on Webflow
- Webflow does not support custom HTTP response headers natively.
- Add the meta tag via the Project Settings: open your project → Project Settings → SEO tab → Extra `<head>` tags → paste `<meta name="referrer" content="strict-origin-when-cross-origin">` → Save and republish.
- For a true HTTP header, use Cloudflare (proxy your Webflow-published domain) → Rules → Transform Rules → Modify Response Header → add `Referrer-Policy: strict-origin-when-cross-origin`.
- Verify via browser DevTools or securityheaders.com after publishing.
How to fix missing referrer policy on Webflow Commerce
- Same as Webflow above — Project Settings → SEO → Extra head tags → add the meta tag, republish.
- Add Cloudflare Modify Response Header rule for the true HTTP header.
How to fix missing referrer policy on Adobe Commerce (Magento)
- For Nginx-hosted stores, open your virtual host config (e.g. `/etc/nginx/sites-available/magento.conf`) and add inside the `server {}` block: `add_header Referrer-Policy "strict-origin-when-cross-origin" always;` — then run `nginx -t && nginx -s reload`.
- For Apache-hosted stores, open `pub/.htaccess` or your VirtualHost config and add: `Header always set Referrer-Policy "strict-origin-when-cross-origin"`.
- Alternatively, add the header programmatically: create a custom module or edit `app/code/YourVendor/YourModule/Plugin/ResponsePlugin.php` to use `$response->setHeader('Referrer-Policy', 'strict-origin-when-cross-origin', true)` via a plugin on `Magento\Framework\App\Response\HttpInterface`.
- For Adobe Commerce Cloud (cloud.magento.com): add the header in `.magento.app.yaml` under the `web.headers` section or use Fastly (the built-in CDN) → Fastly Configuration → Response Object → add the header.
- Run `php bin/magento cache:flush` after any config change and verify with browser DevTools.
How to fix missing referrer policy on Magento Open Source
- Follow the same server-level (Nginx or Apache) steps as Adobe Commerce above.
- For the programmatic approach, create a custom module with a plugin on the HTTP response object to set the header on every response.
- Flush cache: `php bin/magento cache:flush` and verify with browser DevTools.
How to fix missing referrer policy on PrestaShop
- Open your `.htaccess` file in the PrestaShop root and add: `Header always set Referrer-Policy "strict-origin-when-cross-origin"` inside a `<IfModule mod_headers.c>` block.
- For Nginx, add `add_header Referrer-Policy "strict-origin-when-cross-origin" always;` in your server block and reload Nginx.
- Alternatively, edit `config/smarty.config.inc.php` or create an override/module that hooks into the `Header` smarty template to inject the `<meta>` tag into `<head>`.
- Verify with browser DevTools or securityheaders.com.
How to fix missing referrer policy on OpenCart
- Edit your `.htaccess` file (Apache) and add: `Header always set Referrer-Policy "strict-origin-when-cross-origin"` within `<IfModule mod_headers.c>` block.
- For Nginx, add `add_header Referrer-Policy "strict-origin-when-cross-origin" always;` in the server block.
- Alternatively, edit `catalog/view/theme/your-theme/template/common/header.twig` (OpenCart 3+) to add the meta tag inside `<head>`: `<meta name="referrer" content="strict-origin-when-cross-origin">`.
- Verify with browser DevTools.
How to fix missing referrer policy on BigCommerce for WP
- This plugin embeds BigCommerce products within a WordPress site, so the WordPress layer controls headers.
- Use a WordPress security headers plugin (e.g. Headers Security Advanced & HSTS WP) to set `Referrer-Policy: strict-origin-when-cross-origin`.
- Or add the header in `.htaccess` (Apache) / Nginx server block as described in the WooCommerce steps.
Does your site have this issue?
Run a free SEOLZ audit to find missing referrer policy — and every other issue — across your whole site in minutes.
Scan my site freeFrequently asked questions
What is Missing referrer policy?
When a visitor clicks a link or a browser makes a request from your store, it can automatically send a "Referer" header telling the destination site exactly which URL the user came from. The `Referrer-Policy` HTTP header lets you tell browsers how much of that URL to share — the full path, just your domain, or nothing at all. Without this header, browsers fall back to their own default behaviour, which can vary and may expose sensitive URL details (like search query strings, product IDs in cart URLs, or private discount codes) to third-party sites and analytics tools. Setting `Referrer-Policy: strict-origin-when-cross-origin` is the modern recommended default: it sends the full URL for same-site requests (useful for your own analytics) but only your domain name — never the full path — when linking to external sites.
Why does missing referrer policy matter?
Without a `Referrer-Policy` header, sensitive information embedded in your URLs — customer emails, session tokens, promo codes, or internal admin paths — can silently leak to every third-party resource your pages load (ad networks, CDN scripts, fonts, etc.). This is classified under OWASP A05:2021 Security Misconfiguration because it is a straightforward server setting that is simply missing. Beyond privacy and security exposure, Google's guidelines and security-focused ranking signals increasingly reward sites that demonstrate responsible data handling; a missing header also appears as a finding in security audits and PCI-DSS scans that payment processors may require you to pass. Fixing it takes under 30 minutes on most platforms and immediately closes the information-leakage risk for all visitors.
How do I fix missing referrer policy?
Add a `Referrer-Policy: strict-origin-when-cross-origin` HTTP response header to every page so browsers control what referrer information is sent with requests.
Authoritative references
- OWASP Top Ten — OWASP
- OWASP Cheat Sheet Series — OWASP
- Secure Headers Project — OWASP