webzod
account

Stop sending full URLs to other sites on WordPress

headers.referrer.leaky · effort: minutes

Why it matters

unsafe-url sends the full address of the page, including path and query string, to every site it links to or loads from, and no-referrer-when-downgrade does the same for every https site. Those addresses can carry search terms, account IDs or reset tokens.

The fix

  1. Find the plugin, theme or server rule that sets unsafe-url or no-referrer-when-downgrade and change it to strict-origin-when-cross-origin.
  2. Clear page caches and check the header again.

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.