webzod
account

Set a Referrer-Policy on WordPress

headers.referrer.missing · effort: minutes

Why it matters

Without one, how much of your page addresses other sites receive depends on each browser's default. strict-origin-when-cross-origin sends only your domain to other sites and nothing over insecure connections.

The fix

  1. Set it at the CDN or server, with a security-headers plugin, or with the must-use plugin below (pages rendered through PHP only).
wp-content/mu-plugins/referrer-policy.php 
<?php
/*
 * Plugin Name: Referrer-Policy
 */
add_action( 'send_headers', function () {
	header( 'Referrer-Policy: strict-origin-when-cross-origin' );
} );

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.