How to fix missing referrer policy on Wix

Steps for Wix

1. Wix controls all server infrastructure and does not allow custom HTTP response headers to be set by store owners at this time.
2. As a partial mitigation, use Wix's built-in Velo (Dev Mode): enable Dev Mode in your editor, open the masterPage.js file, and add the meta tag via code: $w.onReady(function(){ // Wix does not support setting HTTP headers via Velo; use the HTML embed workaround below. });
3. Go to your Wix Editor → Add Element → Embed → HTML iFrame, and in each page's <head> equivalent add: <meta name="referrer" content="strict-origin-when-cross-origin"> — note this only affects pages where the embed is placed.
4. The most complete solution is to route Wix through Cloudflare (point your DNS to Cloudflare as a proxy) and set the header in a Cloudflare Transform Rule.
5. Contact Wix Support to request native Referrer-Policy header support if a CDN option is not available to you.

What is missing referrer policy?

When someone clicks a link on your site and lands on another website, browsers automatically send a "Referer" header revealing where that visitor came from — sometimes including the full URL path, query string, or even sensitive tokens embedded in URLs. The Referrer-Policy HTTP header is a server instruction that tells browsers exactly how much of that information to share. Without it, browsers fall back on their own defaults, which can vary and may expose more than you intend. Setting it to strict-origin-when-cross-origin — the recommended value — means: send the full URL when staying on your own site, but only send your bare domain name (no path or query string) when linking to external sites, and send nothing at all over unencrypted HTTP.

Without a Referrer-Policy, your shoppers' browsing behaviour — including product pages, search queries, discount codes, or session tokens that appear in URLs — can be silently leaked to every external service you link to (ad networks, social media, review platforms, shipping trackers). This is classified under OWASP A05:2021 Security Misconfiguration because it is a preventable exposure caused by a missing default. Beyond privacy, data-protection regulations like GDPR treat inadvertent transmission of user-identifying URL data as a potential compliance violation, carrying real legal and financial risk. Fixing it costs almost no effort and immediately reduces your attack surface and regulatory exposure, while also preventing analytics distortion caused by referrer spam or inflated referrer data in third-party tools.

See the complete Missing referrer policy guide for every platform and the full background.