Referrer policy missing
The site does not state how much address information browsers may send to other sites.
What is Referrer-Policy?
Referrer-Policy controls how much of the current page address a browser includes when following links or requesting external resources, reducing accidental disclosure of paths and query data.
What to do next
- Use Referrer-Policy: strict-origin-when-cross-origin as a practical baseline. Choose no-referrer if no destination should receive referrer information, or same-origin if only your own site needs it.
- On Apache, add Header always set Referrer-Policy "strict-origin-when-cross-origin" with mod_headers enabled. On Nginx, add add_header Referrer-Policy "strict-origin-when-cross-origin" always; inside the server block.
- On Cloudflare, create a Response Header Transform Rule that sets Referrer-Policy to strict-origin-when-cross-origin. For Drupal, prefer setting the header at Cloudflare or the web server so it also covers cached and non-Drupal responses.
- Clear edge caches, then test external links, analytics attribution, payment journeys and federated sign-in before treating the change as complete.
Useful links
How to verify the fix
Inspect the final response in browser developer tools or with curl -I and confirm there is exactly one Referrer-Policy header with the intended value.
When this result may be wrong
Modern browsers default to strict-origin-when-cross-origin, so this warning does not mean referrer data is currently unrestricted. A meta tag may cover HTML pages but not every response; application-specific flows may justify a stricter or different policy.
Run a fresh report after DNS caches and platform changes have had time to update.