How to fix missing referrer policy on Webflow

Steps for Webflow

1. Webflow does not allow custom HTTP response headers from the Designer or dashboard for sites hosted on Webflow's infrastructure.
2. Inject a <meta> tag site-wide: open your Project Settings → Custom Code → Head Code section, paste: <meta name="referrer" content="strict-origin-when-cross-origin">, then publish your site.
3. Alternatively, export your Webflow site and host it on your own server or Vercel/Netlify, where you can set headers natively (see Headless / Custom steps).
4. For Webflow-hosted sites, routing traffic through Cloudflare and setting the header via a Transform Rule is the recommended production-grade solution.

What is missing referrer policy?

When someone clicks a link on your site and lands on another website, browsers automatically send a "Referer" header revealing where that visitor came from — sometimes including the full URL path, query string, or even sensitive tokens embedded in URLs. The Referrer-Policy HTTP header is a server instruction that tells browsers exactly how much of that information to share. Without it, browsers fall back on their own defaults, which can vary and may expose more than you intend. Setting it to strict-origin-when-cross-origin — the recommended value — means: send the full URL when staying on your own site, but only send your bare domain name (no path or query string) when linking to external sites, and send nothing at all over unencrypted HTTP.

Without a Referrer-Policy, your shoppers' browsing behaviour — including product pages, search queries, discount codes, or session tokens that appear in URLs — can be silently leaked to every external service you link to (ad networks, social media, review platforms, shipping trackers). This is classified under OWASP A05:2021 Security Misconfiguration because it is a preventable exposure caused by a missing default. Beyond privacy, data-protection regulations like GDPR treat inadvertent transmission of user-identifying URL data as a potential compliance violation, carrying real legal and financial risk. Fixing it costs almost no effort and immediately reduces your attack surface and regulatory exposure, while also preventing analytics distortion caused by referrer spam or inflated referrer data in third-party tools.

See the complete Missing referrer policy guide for every platform and the full background.