Missing referrer policy

Quick win

Add a Referrer-Policy HTTP response header set to strict-origin-when-cross-origin to control what URL information browsers send when users navigate away from your store.

What it is

When someone clicks a link on your site and lands on another website, browsers automatically send a "Referer" header revealing where that visitor came from — sometimes including the full URL path, query string, or even sensitive tokens embedded in URLs. The Referrer-Policy HTTP header is a server instruction that tells browsers exactly how much of that information to share. Without it, browsers fall back on their own defaults, which can vary and may expose more than you intend. Setting it to strict-origin-when-cross-origin — the recommended value — means: send the full URL when staying on your own site, but only send your bare domain name (no path or query string) when linking to external sites, and send nothing at all over unencrypted HTTP.

Why it matters

Without a Referrer-Policy, your shoppers' browsing behaviour — including product pages, search queries, discount codes, or session tokens that appear in URLs — can be silently leaked to every external service you link to (ad networks, social media, review platforms, shipping trackers). This is classified under OWASP A05:2021 Security Misconfiguration because it is a preventable exposure caused by a missing default. Beyond privacy, data-protection regulations like GDPR treat inadvertent transmission of user-identifying URL data as a potential compliance violation, carrying real legal and financial risk. Fixing it costs almost no effort and immediately reduces your attack surface and regulatory exposure, while also preventing analytics distortion caused by referrer spam or inflated referrer data in third-party tools.

How to fix it

  1. Confirm the header is missing by opening your browser's DevTools (F12 → Network tab), reloading your homepage, clicking the main document request, and checking the Response Headers panel for Referrer-Policy.
  2. Decide on the value: strict-origin-when-cross-origin is the recommended baseline for ecommerce stores — it balances analytics utility with privacy protection.
  3. Add the header at the server or CDN layer (preferred) so it applies to every page automatically, OR inject it via a <meta> tag in your HTML <head> as a fallback when server-level access is unavailable.
  4. Deploy the change and verify: reload a page, inspect Response Headers (or run a free security-header checker such as securityheaders.com) to confirm Referrer-Policy: strict-origin-when-cross-origin appears.
  5. Check that your internal analytics still receives referrer data as expected (it will — same-origin requests are unaffected by this policy).
  6. Re-run your security scanner or site audit to confirm the finding is resolved.

Fix it on your platform

Pick your platform for the exact steps.

How to fix missing referrer policy on Shopify
  1. Shopify does not expose direct server configuration, so the most reliable method is injecting a <meta> tag into every page via your theme.
  2. In your Shopify Admin, go to Online Store → Themes → click the '...' menu next to your live theme → Edit code.
  3. Open Layout → theme.liquid (the master layout file).
  4. Inside the <head> tag, add: <meta name="referrer" content="strict-origin-when-cross-origin">
  5. Click Save.
  6. For a header-level solution (stronger), use a Cloudflare Worker or a CDN/proxy in front of your Shopify store to inject the HTTP response header automatically.
Full Shopify guide →Official Shopify docs ↗
How to fix missing referrer policy on Shopify Plus
  1. Follow the same theme.liquid approach as standard Shopify (Online Store → Themes → Edit code → theme.liquid → <head>).
  2. Additionally, if you use Cloudflare (common on Plus plans), create a Transform Rule: Security → Transform Rules → Modify Response Header → Add header Referrer-Policy with value strict-origin-when-cross-origin, matching all requests.
  3. Verify in DevTools → Network → Response Headers that the header appears.
Full Shopify Plus guide →Official Shopify Plus docs ↗
How to fix missing referrer policy on WooCommerce
  1. Log in to your WordPress admin.
  2. Install and activate the free plugin 'Headers Security Advanced & HSTS WP' (or 'HTTP Headers' by John Blackbourn) from Plugins → Add New.
  3. Navigate to the plugin settings and enable / add Referrer-Policy with value strict-origin-when-cross-origin.
  4. Alternatively, edit your theme's functions.php (or better, a site-specific plugin) and add: add_action('send_headers', function(){ header('Referrer-Policy: strict-origin-when-cross-origin'); });
  5. For Apache hosts, add 'Header always set Referrer-Policy "strict-origin-when-cross-origin"' inside your .htaccess file or VirtualHost block.
  6. For Nginx hosts, add 'add_header Referrer-Policy "strict-origin-when-cross-origin" always;' inside your server{} or location{} block in nginx.conf, then reload Nginx.
  7. Verify with DevTools or securityheaders.com.
Full WooCommerce guide →Official WooCommerce docs ↗
How to fix missing referrer policy on BigCommerce
  1. BigCommerce does not provide direct HTTP header configuration from the admin panel.
  2. The recommended approach is to place a CDN such as Cloudflare in front of your store and add the header there: Cloudflare Dashboard → your domain → Rules → Transform Rules → Modify Response Header → Add 'Referrer-Policy': 'strict-origin-when-cross-origin'.
  3. As a fallback, inject a <meta> tag via Storefront → Themes → Edit Theme Files → templates/layout/base.html — add <meta name="referrer" content="strict-origin-when-cross-origin"> inside <head>.
  4. Verify in DevTools → Network → Response Headers.
Full BigCommerce guide →Official BigCommerce docs ↗
How to fix missing referrer policy on Wix
  1. Wix controls all server infrastructure and does not allow custom HTTP response headers to be set by store owners at this time.
  2. As a partial mitigation, use Wix's built-in Velo (Dev Mode): enable Dev Mode in your editor, open the masterPage.js file, and add the meta tag via code: $w.onReady(function(){ // Wix does not support setting HTTP headers via Velo; use the HTML embed workaround below. });
  3. Go to your Wix Editor → Add Element → Embed → HTML iFrame, and in each page's <head> equivalent add: <meta name="referrer" content="strict-origin-when-cross-origin"> — note this only affects pages where the embed is placed.
  4. The most complete solution is to route Wix through Cloudflare (point your DNS to Cloudflare as a proxy) and set the header in a Cloudflare Transform Rule.
  5. Contact Wix Support to request native Referrer-Policy header support if a CDN option is not available to you.
Full Wix guide →Official Wix docs ↗
How to fix missing referrer policy on Squarespace
  1. Squarespace does not expose HTTP response header configuration to store owners.
  2. Inject the meta tag via Website → Pages → select any page → Edit → click the gear icon (Page Settings) → Advanced → Header Code Injection. Add: <meta name="referrer" content="strict-origin-when-cross-origin">
  3. For site-wide injection, go to Settings → Advanced → Code Injection → Header and paste the same <meta> tag — this applies it to all pages globally.
  4. For a true HTTP header (stronger), proxy Squarespace through Cloudflare and use a Transform Rule to add the header.
Full Squarespace guide →Official Squarespace docs ↗
How to fix missing referrer policy on Webflow
  1. Webflow does not allow custom HTTP response headers from the Designer or dashboard for sites hosted on Webflow's infrastructure.
  2. Inject a <meta> tag site-wide: open your Project Settings → Custom Code → Head Code section, paste: <meta name="referrer" content="strict-origin-when-cross-origin">, then publish your site.
  3. Alternatively, export your Webflow site and host it on your own server or Vercel/Netlify, where you can set headers natively (see Headless / Custom steps).
  4. For Webflow-hosted sites, routing traffic through Cloudflare and setting the header via a Transform Rule is the recommended production-grade solution.
Full Webflow guide →Official Webflow docs ↗
How to fix missing referrer policy on Adobe Commerce (Magento)
  1. For Apache: open your virtual host configuration or .htaccess at the Magento root and add: Header always set Referrer-Policy "strict-origin-when-cross-origin"
  2. For Nginx: open your nginx.conf or the Magento server block configuration and add inside the server{} block: add_header Referrer-Policy "strict-origin-when-cross-origin" always; — then run 'nginx -t && systemctl reload nginx'.
  3. Alternatively, create a custom Magento module or use an existing security-header extension from the Magento Marketplace to inject the header programmatically.
  4. In the Magento Admin, check Stores → Configuration → General → Web → Base URLs to ensure all URLs use HTTPS (required for strict-origin-when-cross-origin to work correctly cross-origin).
  5. Flush the Magento cache (System → Cache Management → Flush Magento Cache) and verify the header in DevTools.
Full Adobe Commerce (Magento) guide →Official Adobe Commerce (Magento) docs ↗
How to fix missing referrer policy on Magento Open Source
  1. Follow the same Apache/Nginx server-block approach as Adobe Commerce (Magento) above.
  2. For Apache (.htaccess at Magento root): add Header always set Referrer-Policy "strict-origin-when-cross-origin"
  3. For Nginx (server block): add add_header Referrer-Policy "strict-origin-when-cross-origin" always;
  4. Flush caches and verify in DevTools.
Full Magento Open Source guide →Official Magento Open Source docs ↗
How to fix missing referrer policy on Headless / Custom (I build in code)
  1. For Node.js / Express: use the 'helmet' package — app.use(helmet.referrerPolicy({ policy: 'strict-origin-when-cross-origin' }));
  2. For Next.js: add the header in next.config.js under the headers() async function (see code snippet below).
  3. For Netlify: add to netlify.toml under [[headers]] with for = '/*' and values = { Referrer-Policy = 'strict-origin-when-cross-origin' }.
  4. For Vercel: add to vercel.json under 'headers' for source '/(.*)'.
  5. For Apache: add Header always set Referrer-Policy "strict-origin-when-cross-origin" in your .htaccess or VirtualHost block.
  6. For Nginx: add add_header Referrer-Policy "strict-origin-when-cross-origin" always; in your server{} block.
  7. Verify by reloading the site and checking DevTools → Network → Response Headers.
Full Headless / Custom (I build in code) guide →Official Headless / Custom (I build in code) docs ↗
How to fix missing referrer policy on PrestaShop
  1. Edit the .htaccess file in your PrestaShop root directory (for Apache servers) and add: Header always set Referrer-Policy "strict-origin-when-cross-origin"
  2. For Nginx, add add_header Referrer-Policy "strict-origin-when-cross-origin" always; inside your server{} block and reload Nginx.
  3. Alternatively, install a security-headers module from the PrestaShop Addons marketplace.
  4. Verify in DevTools → Network → Response Headers.
Full PrestaShop guide →Official PrestaShop docs ↗
How to fix missing referrer policy on OpenCart
  1. Edit the .htaccess file in your OpenCart root (Apache) and add: Header always set Referrer-Policy "strict-origin-when-cross-origin"
  2. For Nginx, add the header directive to your server block configuration and reload Nginx.
  3. Verify in DevTools after saving.
Full OpenCart guide →Official OpenCart docs ↗
How to fix missing referrer policy on WordPress.org
  1. Install a security-headers plugin such as *Headers Security Advanced & HSTS WP* or *WP Headers* from WP Admin → Plugins → Add New.
  2. Activate the plugin, navigate to its settings page, find the Referrer-Policy option, and set it to `strict-origin-when-cross-origin`.
  3. Alternatively, add the header directly in `.htaccess` (Apache) or your Nginx server block config as described in the WooCommerce steps above.
  4. Verify with browser DevTools → Network tab → document response headers.
Full WordPress.org guide →Official WordPress.org docs ↗
How to fix missing referrer policy on Wix eCommerce
  1. Follow the same steps as standard Wix above — Wix eCommerce shares the same infrastructure and header-injection limitations.
  2. Add the meta tag via Site → SEO & Meta Tags → Additional Tags: `<meta name="referrer" content="strict-origin-when-cross-origin">`.
  3. Use Cloudflare as a proxy with a Modify Response Header rule for the true HTTP header.
Full Wix eCommerce guide →Official Wix eCommerce docs ↗
How to fix missing referrer policy on Squarespace Commerce
  1. Same as Squarespace above — use Settings → Advanced → Code Injection → Header to add the meta tag site-wide: `<meta name="referrer" content="strict-origin-when-cross-origin">`.
  2. Cloudflare proxy + Modify Response Header rule is required for the real HTTP header.
Full Squarespace Commerce guide →Official Squarespace Commerce docs ↗
How to fix missing referrer policy on Webflow Commerce
  1. Same as Webflow above — Project Settings → SEO → Extra head tags → add the meta tag, republish.
  2. Add Cloudflare Modify Response Header rule for the true HTTP header.
Full Webflow Commerce guide →Official Webflow Commerce docs ↗
How to fix missing referrer policy on BigCommerce for WP
  1. This plugin embeds BigCommerce products within a WordPress site, so the WordPress layer controls headers.
  2. Use a WordPress security headers plugin (e.g. Headers Security Advanced & HSTS WP) to set `Referrer-Policy: strict-origin-when-cross-origin`.
  3. Or add the header in `.htaccess` (Apache) / Nginx server block as described in the WooCommerce steps.
Full BigCommerce for WP guide →Official BigCommerce for WP docs ↗

Does your site have this issue?

Run a free SEOLZ scan to find missing referrer policy — and every other issue — across your whole site in minutes.

Scan my site free

Frequently asked questions

What is Missing referrer policy?

When someone clicks a link on your site and lands on another website, browsers automatically send a "Referer" header revealing where that visitor came from — sometimes including the full URL path, query string, or even sensitive tokens embedded in URLs. The Referrer-Policy HTTP header is a server instruction that tells browsers exactly how much of that information to share. Without it, browsers fall back on their own defaults, which can vary and may expose more than you intend. Setting it to strict-origin-when-cross-origin — the recommended value — means: send the full URL when staying on your own site, but only send your bare domain name (no path or query string) when linking to external sites, and send nothing at all over unencrypted HTTP.

Why does missing referrer policy matter?

Without a Referrer-Policy, your shoppers' browsing behaviour — including product pages, search queries, discount codes, or session tokens that appear in URLs — can be silently leaked to every external service you link to (ad networks, social media, review platforms, shipping trackers). This is classified under OWASP A05:2021 Security Misconfiguration because it is a preventable exposure caused by a missing default. Beyond privacy, data-protection regulations like GDPR treat inadvertent transmission of user-identifying URL data as a potential compliance violation, carrying real legal and financial risk. Fixing it costs almost no effort and immediately reduces your attack surface and regulatory exposure, while also preventing analytics distortion caused by referrer spam or inflated referrer data in third-party tools.

How do I fix missing referrer policy?

Add a Referrer-Policy HTTP response header set to strict-origin-when-cross-origin to control what URL information browsers send when users navigate away from your store.

Authoritative references

Related Security (OWASP) issues