Skip to content
Raptor home
Menu

Missing or unsafe Referrer-Policy

security.missing_referrer_policy
Priority
Note
Severity
Info

What we look for

These pages send no Referrer-Policy header (a rule for how much of the page's address is passed to other sites), or set it to unsafe-url or no-referrer-when-downgrade.

Why it matters

A loose policy can pass full addresses, with any private details in them, to other sites. It protects visitors but does not affect search results, so it costs no points.

How to fix

Set Referrer-Policy: strict-origin-when-cross-origin in your server, CDN or hosting settings.

What it cannot know

Current browsers already use strict-origin-when-cross-origin when the header is missing, so a missing header matters mainly in older ones.

Seen in a real crawl

From a crawl of Millbrook Hardware (the broken fixture), a test site from Raptor’s fixture suite.

Note

16 pages have no Referrer-Policy, or an unsafe one

  • /Missing Referrer-Policy header
  • /goneMissing Referrer-Policy header
  • /missingMissing Referrer-Policy header
First 3 of 16 addressesPaths on http://127.0.0.1:8001raptor 0.3.0, 17 Oct 2026

Open this finding in that crawl’s report

It also fired on Kestrel Bay Digital and the js-heavy fixture.

Where you’ll see it

The id is stable, and every surface uses it, so it’s the thing to search for or hand to an agent.

Terminal
When it is one of the five findings under Fix first, raptor crawl prints the id under it.
Check: security.missing_referrer_policy
crawl.json and the CSV
The crawl JSON names the finding by this id, and so do the CSV and raptor_query.
"check_id": "security.missing_referrer_policy"
The HTML report
This link opens the finding in the report, and each finding shows its id.
crawl.html#finding=security.missing_referrer_policy
MCP
raptor_findings with this check_id returns the finding in full, with a fix brief ready to paste into a task. If it didn’t fire, it says why.
raptor_findings {
  "job_id": "...",
  "check_id": "security.missing_referrer_policy"
}