Try it yourself
Four security headers on one homepage response. Three are doing their job. One is set to the value that gives away the most.
Which one would you change?
-
Good. It tells browsers to use https for this domain for the next year, so even a typed http:// address never leaves the machine unencrypted. Only worth switching on once you are certain https works everywhere.
-
Strict, and strict is the point: it says only load things from this site. It takes work to get right, and it is the single most effective header here.
-
One value, no downside. It stops browsers guessing a file is something other than what you said it was.
-
This is the one, and the value says so out loud. It sends the full address of the page a visitor came from to every site you link to — including the path, which on a private or logged-in page can carry an order number, a token or a search somebody would not want shared. strict-origin-when-cross-origin sends the domain only.
Pick a line. Every one of them has an answer.
Show me the answer
Referrer-Policy: unsafe-url
This is the one, and the value says so out loud. It sends the full address of the page a visitor came from to every site you link to — including the path, which on a private or logged-in page can carry an order number, a token or a search somebody would not want shared. strict-origin-when-cross-origin sends the domain only.
The written version
Four headers worth asking your host about →
How to check your own site for this, what to change, and how to confirm it worked.
Now the real thing
Run this check on your own site.
The same check, plus twenty-nine others, against your actual pages. Free, no account, about a minute.