Methodology
Referrer-Policy
ia.referrer-policy · 5.9
Read
MUST
Recommendation
Why it matters
Referrer-Policy controls what URL information is shared when users navigate away from your site. A strict policy protects user privacy and prevents leaking sensitive URL parameters.
How to fix it
Send Referrer-Policy: strict-origin-when-cross-origin or stricter.
-
Add the header to all responses.
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
Verify
curl -sI https://{domain}/
Expected: A Referrer-Policy header
Run a new scan for this checkpoint:
isagentready results {domain} --checkpoint ia.referrer-policy
Details Mapping, lifecycle and references
- AR mapping
- No AR practice
- Evidence source
- MDN: Referrer-Policy
- Score role
- Core
- Introduced
- 2026-08-24
- Methodology version
- 2026-10-22