How to fix missing referrer policy on Headless / Custom (I build in code)

Steps for Headless / Custom (I build in code)

1. For Node.js / Express: use the 'helmet' package — app.use(helmet.referrerPolicy({ policy: 'strict-origin-when-cross-origin' }));
2. For Next.js: add the header in next.config.js under the headers() async function (see code snippet below).
3. For Netlify: add to netlify.toml under [[headers]] with for = '/*' and values = { Referrer-Policy = 'strict-origin-when-cross-origin' }.
4. For Vercel: add to vercel.json under 'headers' for source '/(.*)'.
5. For Apache: add Header always set Referrer-Policy "strict-origin-when-cross-origin" in your .htaccess or VirtualHost block.
6. For Nginx: add add_header Referrer-Policy "strict-origin-when-cross-origin" always; in your server{} block.
7. Verify by reloading the site and checking DevTools → Network → Response Headers.

What is missing referrer policy?

When someone clicks a link on your site and lands on another website, browsers automatically send a "Referer" header revealing where that visitor came from — sometimes including the full URL path, query string, or even sensitive tokens embedded in URLs. The Referrer-Policy HTTP header is a server instruction that tells browsers exactly how much of that information to share. Without it, browsers fall back on their own defaults, which can vary and may expose more than you intend. Setting it to strict-origin-when-cross-origin — the recommended value — means: send the full URL when staying on your own site, but only send your bare domain name (no path or query string) when linking to external sites, and send nothing at all over unencrypted HTTP.

Without a Referrer-Policy, your shoppers' browsing behaviour — including product pages, search queries, discount codes, or session tokens that appear in URLs — can be silently leaked to every external service you link to (ad networks, social media, review platforms, shipping trackers). This is classified under OWASP A05:2021 Security Misconfiguration because it is a preventable exposure caused by a missing default. Beyond privacy, data-protection regulations like GDPR treat inadvertent transmission of user-identifying URL data as a potential compliance violation, carrying real legal and financial risk. Fixing it costs almost no effort and immediately reduces your attack surface and regulatory exposure, while also preventing analytics distortion caused by referrer spam or inflated referrer data in third-party tools.

See the complete Missing referrer policy guide for every platform and the full background.