Try the demo Check my app free
PL-036infoLive posture

No Referrer-Policy

Your page sends no Referrer-Policy, so the browser’s default decides how much of your URLs other sites see.

Severity
Info
Who can exploit it
The sites your pages link to or load files from
Found by
PatchLabs Live posture: your home page’s response headers
Lab proof
Not lab-proven: read from your home page’s response

What it is

When a visitor follows a link or your page loads a file from another site, the browser can send a Referer header saying which page they came from. Referrer-Policy controls how much of that URL is shared. PL-036 means your page doesn’t set one.

Current browsers default to strict-origin-when-cross-origin, which sends only your domain to other sites, so the risk is small. Setting it yourself makes that behaviour explicit, covers older browsers, and matters most for apps that put tokens or personal details in URLs, such as reset links, invite codes or search pages.

Why AI builders produce it

The browser default is reasonable, so nothing visibly breaks without it, and it lives with the other hosting headers that generated projects leave out.

What we see

A synthetic example for app.example.com, shortened. Not taken from any real site.

curl -sI https://app.example.com (response, shortened)
$ curl -sI https://app.example.com
HTTP/2 200
content-type: text/html; charset=utf-8
# no referrer-policy line

Check it yourself

check-pl-036.sh
curl -sI https://your-app.com | grep -i referrer-policy
# also check index.html for <meta name="referrer" ...>

The fix

the header
Referrer-Policy: strict-origin-when-cross-origin

strict-origin-when-cross-origin keeps full URLs within your own site (useful for your analytics) and sends only the domain elsewhere, never over plain HTTP. Use no-referrer if pages carry secrets in their URLs and you need nothing at all to leave.

Vercel

vercel.json
{
  "headers": [
    {
      "source": "/(.*)",
      "headers": [
        { "key": "Referrer-Policy", "value": "strict-origin-when-cross-origin" }
      ]
    }
  ]
}

Put vercel.json at the root of the project and redeploy. If the file already has a headers array, add the object to it rather than starting a second one.

Netlify

public/_headers
# public/_headers  (Vite copies public/ into the publish folder)
/*
  Referrer-Policy: strict-origin-when-cross-origin

The file must end up in your publish directory (dist for Vite). Bolt projects deployed to Netlify use this file too. The same rule can live in netlify.toml under [[headers]] if you prefer one config file.

Cloudflare

For a site proxied through Cloudflare (orange cloud), add a Response Header Transform Rule (Rules → Transform Rules in the dashboard): match all incoming requests to your hostname, then Set static header Referrer-Policy to:

Referrer-Policy · value
strict-origin-when-cross-origin

On Cloudflare Pages or Workers static assets, a _headers file in your build output works the same way as on Netlify.

Lovable

A meta tag in index.html works on any host, including Lovable hosting:

index.html
<!-- index.html, inside <head> -->
<meta name="referrer" content="strict-origin-when-cross-origin">

Live posture findings come with the header or setting to change. PatchLabs never changes your hosting or your repo.

How PatchLabs finds it

live posture · report excerpt
[LOAD]    https://app.example.com/ → 200
          referrer-policy
          not sent · info
synthetic exampleLive posture · read from the home page’s response

Live posture reads the Referrer-Policy header from the final response of its one page load, and the HTML for a <meta name="referrer"> tag. Either one passes.

When the pattern is intended

Relying on the browser default is a reasonable choice for a site with no secrets in its URLs. Setting the header costs one line, so it is listed.

Why it’s rated info

Information: modern browsers already behave safely without it. It costs no points in the Live posture grade.

PL-035

Server headers reveal software versions

A Server or X-Powered-By header names the software and its version, which tells attackers which known bugs to try.

PL-031

Any site can frame the page

Neither frame-ancestors nor X-Frame-Options is set, so another site can load your app invisibly inside its own.

PL-030

No Content-Security-Policy

Your page sends no Content-Security-Policy, so any script that gets onto it can run and send data anywhere.

Guides

Free check

Does your site have PL-036?

Type your site’s address. The free headers check loads your public home page once, like any visitor, and grades HTTPS, the certificate, security headers, cookie flags and mixed content. No sign-up, and the result isn’t stored.

Free, no sign-upLoads your public home page onlyHow Live posture works

Last reviewed 10 Nov 2026. Finding IDs are stable: link to them freely. Spotted a mistake? Tell us.

Previous · PL-035Server headers reveal software versions