Missing Referrer-Policy header

What does this mean?

Without this header, the full URL of the page a visitor came from — which can include sensitive info like a search query or internal path — gets sent to every external site they click through to.

What are the potential impacts?

• Full URLs — including search terms typed into your own site, internal account IDs, or tokens embedded in a link — can leak to any external site a visitor clicks through to.
• Competitors or analytics scrapers on third-party sites can piece together what your users searched for or which internal pages they viewed.
• If a password-reset or invite link is ever passed as a URL parameter, an overly permissive referrer policy can leak that token to a third-party site embedded on the same page.