Referrer-Policy set

What this means

Passing means the response carries a Referrer-Policy header. Failing means it is absent and the browser falls back to its own default for what it sends in the Referer header when a visitor leaves your site. The kit's value, strict-origin-when-cross-origin, sends your full URL to your own pages and only your origin to anyone else.

How we test it

We read the headers on the home page response and look for referrer-policy. Any value passes. Absent fails. We do not grade the value itself, only that you chose one.

Why it matters

Keeps URLs with tokens from leaking to third parties. A password-reset link, an invite code in a query string, a page path that names a customer: all of it rides in the Referer header to every external script, image and link target unless the policy says otherwise. The value in the kit is the one that keeps analytics working and gives outside origins nothing past your domain name.

The fix

Add Referrer-Policy: strict-origin-when-cross-origin to the /(.*) headers block in vercel.json or to securityHeaders in next.config.ts, the same place the other five headers live. Confirm with curl -sI https://YOUR_DOMAIN | grep -i '^referrer-policy', expected referrer-policy: strict-origin-when-cross-origin. The full runbook is in the Fix Kit, Module 01.

Prompt for your AI

Paste this into the coding agent that built the app. It reproduces the finding and stops before changing anything; the fix steps are in the kit.

Do not change anything. This is a verification pass.
Run: curl -sI https://YOUR_DOMAIN | grep -i '^referrer-policy' and show me the output, or tell me it is empty.
Open vercel.json or next.config at the repo root and show me any Referrer-Policy entry, or tell me there is none.
Run: grep -rhoE "https?://[a-zA-Z0-9.-]+" --include='*.html' --include='*.js' --exclude-dir=node_modules . | sort -u and show me the third-party origins the pages load; those are the places the Referer header would reach.
List what it would take to add the header to every route, and stop there.
Run: curl -sI https://YOUR_DOMAIN | grep -ic '^referrer-policy' and show me the output. Expected on a passing site: 1.

Copy the prompt