Set Referrer-Policy header to control data leakage

The Referrer-Policy header controls a genuine, often-overlooked information leakage vector — by default, when a visitor navigates from your site to another, their browser typically sends the full URL of the page they came from, including any potentially sensitive information embedded in that URL, to the destination site.

This leakage becomes a genuine privacy and security concern specifically when your URLs contain sensitive parameters — session identifiers, search queries revealing personal information, or other data you wouldn't want transmitted to third-party sites your visitors subsequently navigate to, all potentially exposed through this default referrer-sharing behavior.

A well-configured Referrer-Policy — commonly "strict-origin-when-cross-origin" as a genuinely balanced default — limits what information gets shared with destination sites based on the security context of the navigation, sending fuller referrer information for same-site navigation while restricting it for cross-site navigation, particularly when moving from a secure HTTPS page to a potentially less secure destination.

This header represents a genuine, meaningful privacy protection for your visitors with essentially no functional downside for legitimate use cases — the modest implementation effort required is disproportionate to the real information-leakage risk this single header configuration closes off.