How to fix missing referrer policy on BigCommerce

Steps for BigCommerce

1. BigCommerce does not provide direct HTTP header configuration from the admin panel.
2. The recommended approach is to place a CDN such as Cloudflare in front of your store and add the header there: Cloudflare Dashboard → your domain → Rules → Transform Rules → Modify Response Header → Add 'Referrer-Policy': 'strict-origin-when-cross-origin'.
3. As a fallback, inject a <meta> tag via Storefront → Themes → Edit Theme Files → templates/layout/base.html — add <meta name="referrer" content="strict-origin-when-cross-origin"> inside <head>.
4. Verify in DevTools → Network → Response Headers.

What is missing referrer policy?

When someone clicks a link on your site and lands on another website, browsers automatically send a "Referer" header revealing where that visitor came from — sometimes including the full URL path, query string, or even sensitive tokens embedded in URLs. The Referrer-Policy HTTP header is a server instruction that tells browsers exactly how much of that information to share. Without it, browsers fall back on their own defaults, which can vary and may expose more than you intend. Setting it to strict-origin-when-cross-origin — the recommended value — means: send the full URL when staying on your own site, but only send your bare domain name (no path or query string) when linking to external sites, and send nothing at all over unencrypted HTTP.

Without a Referrer-Policy, your shoppers' browsing behaviour — including product pages, search queries, discount codes, or session tokens that appear in URLs — can be silently leaked to every external service you link to (ad networks, social media, review platforms, shipping trackers). This is classified under OWASP A05:2021 Security Misconfiguration because it is a preventable exposure caused by a missing default. Beyond privacy, data-protection regulations like GDPR treat inadvertent transmission of user-identifying URL data as a potential compliance violation, carrying real legal and financial risk. Fixing it costs almost no effort and immediately reduces your attack surface and regulatory exposure, while also preventing analytics distortion caused by referrer spam or inflated referrer data in third-party tools.

See the complete Missing referrer policy guide for every platform and the full background.